Error reconnecting to DB COMPROMISES Database Host.

  • mauricionieto1994

    (@mauricionieto1994)


    3 years, 4 months ago

    Hello!

    I found with what I consider a big security issue today.

    I developed a medium sized website with WordPress and today I’ve started to have issues with POST petitions to the wp-cron.php. I searched for this issue and have since fixed it.

    The problem is that I got reports that at certain points (while my site was heavily down) , users got a screen with the error “Error reconnecting to the database” AND below that, a small paragraph where it explicitily writes the name of my database host.

    This is the code that I found where it adds the database host:

    $message = ‘<h1>’ . __( ‘Error reconnecting to the database’ ) . “</h1>\n”;

    $message .= ‘<p>’ . sprintf(
    /* translators: %s: Database host. */
    __( ‘This means that we lost contact with the database server at %s. This could mean your host’s database server is down.’ ),
    ‘' . htmlspecgialchars( $this->dbhost, ENT_QUOTES ) . '‘
    ) . “</p>\n”;

    This is terrible in my opinion since now I have to go and rename my database instance , since I find the database host a sensitive parameter. I am actually quite worried right now and I want to know how can I make it so this never happens again? I understand that websites can sometimes go down, but I dont want my database host info printed on anybodys screen! As a matter of fact, Im wondering if the problem of the POSTs at the wp-cron.php were made for this exact purpose, to extract my database host? Again, I am very worried.

    Please let me know if there is a way as to make this never happen again. Any help would be greatly appreciated

    • This topic was modified 3 years, 4 months ago by mauricionieto1994. Reason: EDIT: I added the code that I found on the core where it explicitly prints the database host on screen
Viewing 3 replies - 1 through 3 (of 3 total)
  • Moderator Tellyworth

    (@tellyworth)

    3 years, 4 months ago

    This message is only displayed if WP_DEBUG and WP_DEBUG_DISPLAY are enabled. Which are disabled by default, and should not be enabled on a production site.

    In future please don’t report possible security issues on a public forum. This explains where to go for security reports: https://make.wordpress.org/core/handbook/testing/reporting-security-vulnerabilities/#where-do-i-report-security-issues

    Thread Starter mauricionieto1994

    (@mauricionieto1994)

    3 years, 4 months ago

    @tellyworth Sorry if I used the wrong forum for this.

    Concerning your response, on my site, that is not the case. WP_DEBUG is false.

    I am looking at the code of wp-db.php and I do see a way for this to be printed on a method called bail(). This is the full snippet.

    // We weren't able to reconnect, so we better bail.
$this->bail( $message, 'db_connect_fail' );

// Call dead_db() if bail didn't die, because this database is no more.
// It has ceased to be (at least temporarily).
dead_db();

    If the process dies inside the bail, wether WP_DEBUG is true or false, it does print the host on the front. This rarely happens but it does, most of the time it ends on dead_db(), and then nothing gets printed.

    Moderator Tellyworth

    (@tellyworth)

    3 years, 4 months ago

    It’s the bail() function that checks WP_DEBUG, via $this->show_errors.

    I tested this with WordPress 5.6 and the detailed error message definitely is not displayed with WP_DEBUG set to false. If you are seeing debug info it’s most likely because something on your site is intentionally configured to display it.

    Again, if you have a security bug to report, please don’t use this public forum. If you’re able to reproduce this problem on a clean test site without plugins enabled, report it using HackerOne as advised here: https://make.wordpress.org/core/handbook/testing/reporting-security-vulnerabilities/#where-do-i-report-security-issues

Viewing 3 replies - 1 through 3 (of 3 total)
  • The topic ‘Error reconnecting to DB COMPROMISES Database Host.’ is closed to new replies.