{"id":2759,"date":"2014-07-16T16:21:04","date_gmt":"2014-07-16T20:21:04","guid":{"rendered":"http:\/\/blog.funio.com\/fr\/?p=2759"},"modified":"2014-07-16T16:22:57","modified_gmt":"2014-07-16T20:22:57","slug":"vulnerabilite-dans-le-module-wordpress-wptouch","status":"publish","type":"post","link":"http:\/\/blog.funio.com\/fr\/2014\/07\/vulnerabilite-dans-le-module-wordpress-wptouch\/","title":{"rendered":"Vuln\u00e9rabilit\u00e9 dans le module WordPress \u00ab WPtouch \u00bb"},"content":{"rendered":"<p>\u00c0 nouveau, l\u2019\u00e9quipe de <a href=\"http:\/\/blog.sucuri.net\/2014\/07\/disclosure-insecure-nonce-generation-in-wptouch.html\" target=\"_blank\">Sucuri.net<\/a> a trouv\u00e9 une vuln\u00e9rabilit\u00e9 dans un module WordPress tr\u00e8s populaire, soit WPtouch\u00a03.x, qui connait plus de 5 millions de t\u00e9l\u00e9chargements.<\/p>\n<p><strong>Si vous utilisez WPtouch\u00a03.x, vous devriez arr\u00eater votre lecture ici et aller faire la mise \u00e0 jour du module par l\u2019interface administrative de WordPress imm\u00e9diatement.<\/strong><\/p>\n<p>WPtouch a \u00e9t\u00e9 tr\u00e8s rapide \u00e0 <a href=\"http:\/\/www.wptouch.com\/releases\/security-fix-wptouch-wptouch-pro-3-4-3-insecure-nonce-generation-wptouch\/\" target=\"_blank\">r\u00e9pondre<\/a> et r\u00e9parer le probl\u00e8me, et une mise \u00e0 jour a \u00e9t\u00e9 rendue disponible avec la version\u00a03.4.3 pour r\u00e9parer le probl\u00e8me. Veuillez prendre note que les versions\u00a01.x et 2.x ne sont pas affect\u00e9s par cette vuln\u00e9rabilit\u00e9.<\/p>\n<h3>La faille de s\u00e9curit\u00e9<\/h3>\n<p>La vuln\u00e9rabilit\u00e9 permettrait \u00e0 un attaquant de potentiellement prendre le contr\u00f4le d\u2019un site Web en t\u00e9l\u00e9versant un \u00ab\u00a0Shell\u00a0\u00bb dans un r\u00e9pertoire du site Web. En cons\u00e9quence, la personne mal intentionn\u00e9e pourrait facilement t\u00e9l\u00e9verser du code ou des logiciels malveillants dans le site.<\/p>\n<p>Comment? Au travers la cr\u00e9ation d\u2019un nonce non s\u00e9curis\u00e9 (un nonce est un nombre unique arbitraire qui peut \u00eatre utilis\u00e9 qu\u2019une seule fois). Si votre site permet l\u2019acc\u00e8s \u00e0 des utilisateurs invit\u00e9s (\u00ab\u00a0guest\u00a0\u00bb), un nouvel invit\u00e9 attaquant aurait simplement besoin de se connecter et obtenir le nonce par wp-admin, pour ensuite faire une demande de t\u00e9l\u00e9versement d\u2019un fichier AJAX avec le nonce divulgu\u00e9 avec le fichier malveillant.<\/p>\n<p>\u00c0 nouveau, si vous utilisez WPtouch, allez effectuer votre mise \u00e0 jour maintenant!<\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u00c0 nouveau, l\u2019\u00e9quipe de Sucuri.net a trouv\u00e9 une vuln\u00e9rabilit\u00e9 dans un module WordPress tr\u00e8s populaire, soit WPtouch\u00a03.x, qui connait plus de 5 millions de t\u00e9l\u00e9chargements. Si vous utilisez WPtouch\u00a03.x, vous devriez arr\u00eater votre lecture ici et aller faire la mise \u00e0 jour du module par l\u2019interface administrative de WordPress imm\u00e9diatement. WPtouch a \u00e9t\u00e9 tr\u00e8s rapide [&#8230;]<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[7,88,141,120,140],"class_list":["post-2759","post","type-post","status-publish","format-standard","hentry","category-hebergement-web","tag-default","tag-httpmedia-funio-comimageskbblogwordpress-logo-png","tag-security","tag-wordpress","tag-wptouch"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.7 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Vuln\u00e9rabilit\u00e9 dans le module WordPress \u00ab WPtouch \u00bb &#8212; Funio Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"http:\/\/blog.funio.com\/fr\/2014\/07\/vulnerabilite-dans-le-module-wordpress-wptouch\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Vuln\u00e9rabilit\u00e9 dans le module WordPress \u00ab WPtouch \u00bb &#8212; Funio Blog\" \/>\n<meta property=\"og:description\" content=\"\u00c0 nouveau, l\u2019\u00e9quipe de Sucuri.net a trouv\u00e9 une vuln\u00e9rabilit\u00e9 dans un module WordPress tr\u00e8s populaire, soit WPtouch\u00a03.x, qui connait plus de 5 millions de t\u00e9l\u00e9chargements. Si vous utilisez WPtouch\u00a03.x, vous devriez arr\u00eater votre lecture ici et aller faire la mise \u00e0 jour du module par l\u2019interface administrative de WordPress imm\u00e9diatement. WPtouch a \u00e9t\u00e9 tr\u00e8s rapide [...]\" \/>\n<meta property=\"og:url\" content=\"http:\/\/blog.funio.com\/fr\/2014\/07\/vulnerabilite-dans-le-module-wordpress-wptouch\/\" \/>\n<meta property=\"og:site_name\" content=\"Funio Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/FunioHosting\" \/>\n<meta property=\"article:published_time\" content=\"2014-07-16T20:21:04+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2014-07-16T20:22:57+00:00\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@funiohosting\" \/>\n<meta name=\"twitter:site\" content=\"@funiohosting\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"1 minute\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"http:\\\/\\\/blog.funio.com\\\/fr\\\/2014\\\/07\\\/vulnerabilite-dans-le-module-wordpress-wptouch\\\/#article\",\"isPartOf\":{\"@id\":\"http:\\\/\\\/blog.funio.com\\\/fr\\\/2014\\\/07\\\/vulnerabilite-dans-le-module-wordpress-wptouch\\\/\"},\"author\":{\"name\":\"\",\"@id\":\"\"},\"headline\":\"Vuln\u00e9rabilit\u00e9 dans le module WordPress \u00ab WPtouch \u00bb\",\"datePublished\":\"2014-07-16T20:21:04+00:00\",\"dateModified\":\"2014-07-16T20:22:57+00:00\",\"mainEntityOfPage\":{\"@id\":\"http:\\\/\\\/blog.funio.com\\\/fr\\\/2014\\\/07\\\/vulnerabilite-dans-le-module-wordpress-wptouch\\\/\"},\"wordCount\":257,\"commentCount\":0,\"keywords\":[\"Default\",\"http:\\\/\\\/media.funio.com\\\/images\\\/kb\\\/blog\\\/wordpress-logo.png\",\"security\",\"wordpress\",\"wptouch\"],\"articleSection\":[\"H\u00e9bergement Web\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"http:\\\/\\\/blog.funio.com\\\/fr\\\/2014\\\/07\\\/vulnerabilite-dans-le-module-wordpress-wptouch\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"http:\\\/\\\/blog.funio.com\\\/fr\\\/2014\\\/07\\\/vulnerabilite-dans-le-module-wordpress-wptouch\\\/\",\"url\":\"http:\\\/\\\/blog.funio.com\\\/fr\\\/2014\\\/07\\\/vulnerabilite-dans-le-module-wordpress-wptouch\\\/\",\"name\":\"Vuln\u00e9rabilit\u00e9 dans le module WordPress \u00ab WPtouch \u00bb &#8212; Funio Blog\",\"isPartOf\":{\"@id\":\"http:\\\/\\\/blog.funio.com\\\/fr\\\/#website\"},\"datePublished\":\"2014-07-16T20:21:04+00:00\",\"dateModified\":\"2014-07-16T20:22:57+00:00\",\"author\":{\"@id\":\"\"},\"breadcrumb\":{\"@id\":\"http:\\\/\\\/blog.funio.com\\\/fr\\\/2014\\\/07\\\/vulnerabilite-dans-le-module-wordpress-wptouch\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"http:\\\/\\\/blog.funio.com\\\/fr\\\/2014\\\/07\\\/vulnerabilite-dans-le-module-wordpress-wptouch\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"http:\\\/\\\/blog.funio.com\\\/fr\\\/2014\\\/07\\\/vulnerabilite-dans-le-module-wordpress-wptouch\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"http:\\\/\\\/blog.funio.com\\\/fr\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Vuln\u00e9rabilit\u00e9 dans le module WordPress \u00ab WPtouch \u00bb\"}]},{\"@type\":\"WebSite\",\"@id\":\"http:\\\/\\\/blog.funio.com\\\/fr\\\/#website\",\"url\":\"http:\\\/\\\/blog.funio.com\\\/fr\\\/\",\"name\":\"Funio Blog\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"http:\\\/\\\/blog.funio.com\\\/fr\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"\",\"url\":\"http:\\\/\\\/blog.funio.com\\\/fr\\\/author\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Vuln\u00e9rabilit\u00e9 dans le module WordPress \u00ab WPtouch \u00bb &#8212; Funio Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"http:\/\/blog.funio.com\/fr\/2014\/07\/vulnerabilite-dans-le-module-wordpress-wptouch\/","og_locale":"en_US","og_type":"article","og_title":"Vuln\u00e9rabilit\u00e9 dans le module WordPress \u00ab WPtouch \u00bb &#8212; Funio Blog","og_description":"\u00c0 nouveau, l\u2019\u00e9quipe de Sucuri.net a trouv\u00e9 une vuln\u00e9rabilit\u00e9 dans un module WordPress tr\u00e8s populaire, soit WPtouch\u00a03.x, qui connait plus de 5 millions de t\u00e9l\u00e9chargements. Si vous utilisez WPtouch\u00a03.x, vous devriez arr\u00eater votre lecture ici et aller faire la mise \u00e0 jour du module par l\u2019interface administrative de WordPress imm\u00e9diatement. WPtouch a \u00e9t\u00e9 tr\u00e8s rapide [...]","og_url":"http:\/\/blog.funio.com\/fr\/2014\/07\/vulnerabilite-dans-le-module-wordpress-wptouch\/","og_site_name":"Funio Blog","article_publisher":"https:\/\/www.facebook.com\/FunioHosting","article_published_time":"2014-07-16T20:21:04+00:00","article_modified_time":"2014-07-16T20:22:57+00:00","twitter_card":"summary_large_image","twitter_creator":"@funiohosting","twitter_site":"@funiohosting","twitter_misc":{"Written by":"","Est. reading time":"1 minute"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"http:\/\/blog.funio.com\/fr\/2014\/07\/vulnerabilite-dans-le-module-wordpress-wptouch\/#article","isPartOf":{"@id":"http:\/\/blog.funio.com\/fr\/2014\/07\/vulnerabilite-dans-le-module-wordpress-wptouch\/"},"author":{"name":"","@id":""},"headline":"Vuln\u00e9rabilit\u00e9 dans le module WordPress \u00ab WPtouch \u00bb","datePublished":"2014-07-16T20:21:04+00:00","dateModified":"2014-07-16T20:22:57+00:00","mainEntityOfPage":{"@id":"http:\/\/blog.funio.com\/fr\/2014\/07\/vulnerabilite-dans-le-module-wordpress-wptouch\/"},"wordCount":257,"commentCount":0,"keywords":["Default","http:\/\/media.funio.com\/images\/kb\/blog\/wordpress-logo.png","security","wordpress","wptouch"],"articleSection":["H\u00e9bergement Web"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["http:\/\/blog.funio.com\/fr\/2014\/07\/vulnerabilite-dans-le-module-wordpress-wptouch\/#respond"]}]},{"@type":"WebPage","@id":"http:\/\/blog.funio.com\/fr\/2014\/07\/vulnerabilite-dans-le-module-wordpress-wptouch\/","url":"http:\/\/blog.funio.com\/fr\/2014\/07\/vulnerabilite-dans-le-module-wordpress-wptouch\/","name":"Vuln\u00e9rabilit\u00e9 dans le module WordPress \u00ab WPtouch \u00bb &#8212; Funio Blog","isPartOf":{"@id":"http:\/\/blog.funio.com\/fr\/#website"},"datePublished":"2014-07-16T20:21:04+00:00","dateModified":"2014-07-16T20:22:57+00:00","author":{"@id":""},"breadcrumb":{"@id":"http:\/\/blog.funio.com\/fr\/2014\/07\/vulnerabilite-dans-le-module-wordpress-wptouch\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["http:\/\/blog.funio.com\/fr\/2014\/07\/vulnerabilite-dans-le-module-wordpress-wptouch\/"]}]},{"@type":"BreadcrumbList","@id":"http:\/\/blog.funio.com\/fr\/2014\/07\/vulnerabilite-dans-le-module-wordpress-wptouch\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"http:\/\/blog.funio.com\/fr\/"},{"@type":"ListItem","position":2,"name":"Vuln\u00e9rabilit\u00e9 dans le module WordPress \u00ab WPtouch \u00bb"}]},{"@type":"WebSite","@id":"http:\/\/blog.funio.com\/fr\/#website","url":"http:\/\/blog.funio.com\/fr\/","name":"Funio Blog","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"http:\/\/blog.funio.com\/fr\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"","url":"http:\/\/blog.funio.com\/fr\/author\/"}]}},"_links":{"self":[{"href":"http:\/\/blog.funio.com\/fr\/wp-json\/wp\/v2\/posts\/2759","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/blog.funio.com\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/blog.funio.com\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/blog.funio.com\/fr\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"http:\/\/blog.funio.com\/fr\/wp-json\/wp\/v2\/comments?post=2759"}],"version-history":[{"count":2,"href":"http:\/\/blog.funio.com\/fr\/wp-json\/wp\/v2\/posts\/2759\/revisions"}],"predecessor-version":[{"id":2761,"href":"http:\/\/blog.funio.com\/fr\/wp-json\/wp\/v2\/posts\/2759\/revisions\/2761"}],"wp:attachment":[{"href":"http:\/\/blog.funio.com\/fr\/wp-json\/wp\/v2\/media?parent=2759"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/blog.funio.com\/fr\/wp-json\/wp\/v2\/categories?post=2759"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/blog.funio.com\/fr\/wp-json\/wp\/v2\/tags?post=2759"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}