Worpress security warning

mocsokmike · Posted: Mon Oct 01, 2018 11:03 am Post subject: Worpress security warning

Hi,

for a user request I installed a wordpress on our corporate webserver. The package itself was in testing (~amd64 keyword), and after installing I ran webapp-config, which gave me this message:

bunder · Bodhisattva Joined: 10 Apr 2004 Posts: 5934

All it means is that it might take a couple days for an updated ebuild when wordpress needs to push out a new version (which happens somewhat regularly) to fix security issues. Since wordpress is one of the biggest CMS packages, it's a common target for bots exploiting security holes. Wordpress internally tracks for new versions on the dashboard, so if they put out a new version and you don't have an ebuild yet, you might want to consider setting up an overlay where you can temporarily bump the packages yourself until the main portage tree catches up.
_________________

mocsokmike · Posted: Mon Oct 01, 2018 1:15 pm Post subject:

Oh, that's OK. I will keep an eye on it.
Still, it is easier to use portage to update it automatically.
Thanks for the explanation!
_________________
format c:
emerge system

Hu · Moderator Joined: 06 Mar 2007 Posts: 21595

In my opinion, it is extremely dangerous to run a Wordpress install that is accessible over the network to anyone to whom you would not entrust a local shell. If the blog is run solely internally, it might be an acceptable risk. (Remember that you must worry about every employee, and every bit of malware that might ride in on an employee's device.) If the blog is exposed to the world, I would not do it.

mocsokmike · Posted: Tue Oct 02, 2018 3:27 pm Post subject:

@Hu, can you elaborate? In our case, this site would be accessible from the Internet.
_________________
format c:
emerge system

hdcg · Tux's lil' helper Joined: 07 Apr 2013 Posts: 120

Hi mocsokmike,

to give you an idea:

https://www.wordfence.com/blog/2017/04/march-2017-wordpress-attack-report/
https://sucuri.net/reports/2017-hacked-website-report
https://wpplugins.tips/wordpress-security-statistics/

Due to the wide use of Wordpress it is the number one any attacker's list and attacks are well supported.
Wordpress "supports" this by it's overhelming funcationality and a huge number of not always well maintained plugins.

I did once run a Wordpress site and the continous attack attempts made me switch to a more simple file based CMS.

My insights from this experienca are:

Prepare for continous support/monitoring of the site
Use a setup capable of performing self-updates (to be prepared for zero-day-exploits); I do not know whether the ebuild based setup supports this
Avoid plugins (at least ones of poor quality)
Look out for more security related Wordpress tipps

Best Regards,
Holger

mocsokmike · Posted: Tue Oct 02, 2018 4:13 pm Post subject:

Thank you, Holger. This really made me think about using something else instead of WP.
I don't prefer being in the spotlight of hackers.
_________________
format c:
emerge system

Hu · Moderator Joined: 06 Mar 2007 Posts: 21595

Wordpress has a history of severe security problems, including allowing remote users to obtain code execution on the system running the Wordpress install. If your use case is exposing the content to the Internet, I would not trust Wordpress to do the job safely.

Muso · Posted: Fri Oct 05, 2018 12:36 am Post subject:

There are 1,107 Wordpress exploits on the ExploitDB. There are guaranteed some being sold on the deepweb as well.
_________________
"You can lead a horticulture but you can't make her think" ~ Dorothy Parker
2021 is the year of the Linux Desktop!