Security Tip: Timthumb.php
August 2nd, 2011 at 2:36 pmWe’d like to make sure you all know about a serious vulnerability that was recently discovered in a popular image re-sizing tool called “timthumb.php”. This affects many WordPress themes and other PHP-driven websites. Read on for technical details and quick instructions on how to keep your sites secure.
Who might be affected?
- Anyone with a PHP-driven website which is running timthumb.php.
- Many WordPress themes utilize timthumb.php by default.
- This is not unique to a single web hosting provider.
What does timthumb.php do?
Many developers use “timthumb.php” to resize images to fit their website. It also allows you to pull images from external sites, which is very cool, but there’s a catch… The same feature may allow attackers to upload malicious scripts. In a worst-case, this could result in file corruption or even data loss.
Can you give me an example?
You can use timthumb to pull an image directly from your Flickr account and re-size it for your blog. Neat, huh? But, malicious users may also use it to pull scripts from “flickr.com.evilhackersite.com” or another malicious location. Once the attackers gain access, your site and data will be wide open to a variety of malicious activities.
If you’d like more info, there’s a pretty great write-up here:
http://mdtm.pl/timthumb-info
Note: Timthumb.php is included in many WordPress themes but this is not a WordPress issue. It can be used on just about any kind of PHP-driven site.
How can I stay secure?
To start, if you’re using timthumb.php, you’ll want to make sure you have the latest version. In general, it’s very important that you keep all third-party software up-to-date. Having said that, since the developers of timthumb.php have yet to patch the vulnerability, you’ll probably want to discontinue using it altogether until an update is available. We’ll post here again when a solution is available.
In addition, it’s strongly recommended that you change all WordPress or other CMS passwords and credentials, as they may have already been exposed to attackers. You’ll also want to familiarize yourself with how to keep your website secure against the bad guys. A great resource for this is the Google Webmaster Central Blog.
Hopefully this information will help you address this issue before it affects your sites. Stay tuned for more security-related posts from (mt). As always, feel free to contact us at any time with questions or feedback.
» 
August 3rd, 2011 at 4:55 am
Just to clarify, TimThumb has received a number of patches since the flaw was first found and it is now much harder (I don’t want to say impossible) to exploit the script so it’s definitely worth updating. If you can find any other flaws please post on google code issues and I can look into it.
August 3rd, 2011 at 10:31 am
Don’t just search for timthumb.php, use: find . | grep php | xargs grep -s timthumb ( Reference: http://t.co/hdNUyvR )
August 13th, 2011 at 6:09 am
Thanks allot MT, just another reason to stay with you guys.
August 17th, 2011 at 5:02 am
Thanks for that MT – you guys are brilliant!
August 17th, 2011 at 9:57 am
Thanks y’all! Updated! Darn off-the-shelf WordPress themes!
August 30th, 2011 at 10:37 am
Woo! Great article, and that grep replacement command in the comments rocks, MaXe!
October 21st, 2011 at 2:42 am
It would be nice if we could use add_image_size in the same fashion, but that only impacts images uploaded after the fact… with the dynamic resizing we can set the sizes at any time….
December 8th, 2011 at 8:53 am
All of the sites I have running Chris Pearson’s “Thesis” theme have been affected, but it’s not in your list.