6

After a security inspection of a site running Wordpress with a REST API, the scanner flagged the route /wp-json/ as a vulnerability due to a very flexible CORS policy that allows third parties to interact with the service. However, I can not find a concrete source of sensitive information that could be stolen without requiring more information from the victim. For example, the Wordpress REST API offers several ways to authenticate users, so I thought maybe one of them would be vulnerable.

  1. Cookie based authentication. It seems to be useful only for themes and plugins and the user needs to provide a nonce to have access to the resources.
  2. Basic Authentication. It requires a base 64 encoded header with the user credentials.
  3. oAuth. It needs to be configured by providing tokens to clients and registering those clients in the main service and I think you need to provide this token in every request.

If you have other ideas or corrections, please let me know.

Is there some security risk in having a REST API with CORS enabled?

UPDATE:

As an additional clarification, in this particular case, the Access-Control-Allow-Origin: * restrictions are programatically bypassed by setting Access-Control-Allow-Origin header based on the Origin header from the request. Usually, this would be enough to have concerns, but in this case, I'm not sure if the authentication mechanisms offered by the REST API are enough to protect against CORS-related vulnerabilities.

Improve this question

1 Answer 1

Reset to default
3

CORS is a commonly misunderstood mechanism and even some security scanners get it wrong. For example some will flag Access-Control-Allow-Origin: * as a serious concern, without realising that the browser won't send credentials (e.g. cookies) with the request (you can't combine that wildcard value with Access-Control-Allow-Credentials: true).

That's the most common case, hard to say if that's what's been reported in your case without the details of your CORS policy.

The main risk I can think of, of having a REST API with CORS would be if an untrusted origin was listed in ACAO, you had ACAC: true set and a user visited the untrusted origin whilst authenticated to the site and a request was passed with their cookie(s) to the site allowing for protected content to be retrieved, as you can see a fairly convoluted setup.

If you want more information on CORS, I'd recommend reading this and this. Also worth noting that Wordpress's REST API may have some security concerns for example, retrieval of valid usernames without authentication

Improve this answer
2
  • Thank you. If I remember correctly, the scanner reported this because of what you described in the third paragraph: They bypassed the Access-Control-Allow-Origin: * restrictions by programatically setting the ACAO header based on the Origin from the request. They also included Access-Control-Allow-Credentials: true. Assuming this setup, is there some risk of exposing the /wp-json route?
    – r_31415
    Dec 21, 2016 at 17:11
  • Access-Control-Allow-Origin: * can still be dangerous even when no ambient authority (e.g. cookies) is involved. The attacker may want to use the victim's position within a private network to exfiltrate data from a server (e.g. bound to localhost) that isn't directly accessible.
    – jub0bs
    Aug 27, 2021 at 10:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .