After a security inspection of a site running Wordpress with a REST API, the scanner flagged the route /wp-json/ as a vulnerability due to a very flexible CORS policy that allows third parties to interact with the service. However, I can not find a concrete source of sensitive information that could be stolen without requiring more information from the victim. For example, the Wordpress REST API offers several ways to authenticate users, so I thought maybe one of them would be vulnerable.
- Cookie based authentication. It seems to be useful only for themes and plugins and the user needs to provide a nonce to have access to the resources.
- Basic Authentication. It requires a base 64 encoded header with the user credentials.
- oAuth. It needs to be configured by providing tokens to clients and registering those clients in the main service and I think you need to provide this token in every request.
If you have other ideas or corrections, please let me know.
Is there some security risk in having a REST API with CORS enabled?
UPDATE:
As an additional clarification, in this particular case, the Access-Control-Allow-Origin: *
restrictions are programatically bypassed by setting Access-Control-Allow-Origin
header based on the Origin
header from the request. Usually, this would be enough to have concerns, but in this case, I'm not sure if the authentication mechanisms offered by the REST API are enough to protect against CORS-related vulnerabilities.