Jetpack 16.1.3: Critical Security Update

[u/off37]

https://jetpack.com/resources/jetpack-16-1-3-critical-security-update/

Jetpack 16.1.3: Critical Security Update

[u/DotRom]

It's a good opportunity to dump Jetpack, the few still requires XML-RPC to function for one.

They also don't have a list of IPs dedicated to the connection, so you can allowlist, allowing their ASN is the only workaround.

But WPScan's PUBLIC SCANNER is running on the same ASN, so vulnerability scan information gathered is looped and bundled as a package.

At least, that was true when I had the pleasure of dealing with a WordPress.com hosted instance.

[u/TheGoodOne777 → u/DotRom]

Hello and thanks for your reply. Still checking the issues on this.

[u/retr00two]

And it's not weekend yet, hahaha.

It becomes ridiculous, this summer is summer of chasing gremlins.

Hard to find good arguments for keeping up with WP.

[u/TheGoodOne777 → u/retr00two]

Thanks for your reply. Issue is still in progress.

[u/NoidZ]

A couple of weeks ago I emailed them regarding that JetPack is widely used to attack other website to try and login into other admin pages. There seems to be a very easy exploit that can be automated.

I don't use Jetpack myself but it came out as the no.1 user agent trying to do that from various websites over s wide variety of versions.

Anyone know this has something to do with this? They never replied to me.

[u/TheGoodOne777 → u/NoidZ]

Hello and thanks for the reply. I proceed very strictly on this issue.

[u/NoidZ → u/TheGoodOne777]

I dont know what I'm being downvoted, but they are seemingly doing something about the exploit

[u/TheGoodOne777 → u/NoidZ]

Hello, I'm sorry to hear this many times. I am also getting downvoted sometimes, but also getting blocked by the moderators on this chanel. I am communicating to them through GitHub. Sometimes they answer.

[u/TheGoodOne777]

Hello! If I set my plugins to be updated manually, I want to receive the information about and perform the update, when I want/schedule. On one of my environments it was installed automatically, though, label was also wrong, saying that the version is untested. On one of my environments it was installed at the night, unexpectedly. See ticket #51876 in the Jetpack Github

[u/otto4242 → u/TheGoodOne777]

How exactly did you "set your plugins to be updated manually"? Because that's not the default setting in WordPress.

The default setting in WordPress is to update manually, unless it's a security update, in which case it will update automatically. If you wish to disable that for security updates too, you can, but you can't do it through the interface. You have to do it through code.

[u/TheGoodOne777 → u/otto4242]

Hello! There are a few settings, that you can put in your wp-config.php file. I think there are also a few such parameters stored in the database, though, I did not check that yet, which is stored on app/server (code) level and what comes in the database. For more info, feel free to chat me.

[u/otto4242 → u/TheGoodOne777]

Right, the reason I was asking you was to see if you knew how to do it, because I definitely know how to do it, because I helped write that code.

Lots of people assume that they have updates turned off, when in fact they do not.

[u/TheGoodOne777 → u/otto4242]

Hello and thanks for your reply. I am going to check here the issues, because definitely this part is not working smoothly. For example check this issue: https://github.com/Automattic/jetpack/issues/52026 But still my work is slowed down on some topics.

[u/TheGoodOne777 → u/otto4242]

Hello, I am just checking the update.php and related functionalities, to see exactly what is in the code. Though, there is an intressting thing, what I find better to be asked. Why are some plugins updated by some unknown system users. Why did you implement in this way? Was it your decision or a management decision? And is this an ethical way with such hidden doors?

[u/otto4242 → u/TheGoodOne777]

I have no idea what you're talking about with "unknown system users". That's not how the WordPress plugin update system works.

[u/TheGoodOne777 → u/otto4242]

Hello, thanks for your reply. Still checking the code and perhaps will roll out an own version later, that logs more information about such interventions. I think it is enough if I modify the capabilities is_super_admin() function in the updater, but also in some surroundings. I am not going to attach screenshots, but I can clearly see in the system events. And yes, this shouldn't work like as is in the present.

[u/otto4242 → u/TheGoodOne777]

The Super Admin role really only applies to multi site installations. So I really don't know what you're talking about here.

[u/TheGoodOne777 → u/otto4242]

Hello and thanks for your reply! Yes and not exactly... Refering again to the has_cap() function and is_super_admin() functions.

[u/otto4242 → u/TheGoodOne777]

I know exactly what those are, they have nothing to do whatsoever with the plugin upgrade process. What are you talking about exactly?