0

I recently came across a WordPress (v 4.7.2) site with an exposed wp-config.php file, within which plain text server authorisation key secrets were accessible.
Having read Mike Czumak's article on generating WordPress cookie, I understand on a high level how the generation of WP auth session cookies may work: http://www.securitysift.com/understanding-wordpress-auth-cookies/

The pertinent host dependent inputs required for the brute-force process are a valid WordPress user ID, server name and the server AUTH secrets from wp-config.php.

The article however applies to WordPress 3.9. I'm wondering if the brute force attack described in the article is possible in newer versions. I tried the POC and found that the version 3.9 auth cookies generated were in a shorter format than those required for 4.7.2.
Comparison of the WordPress source code reveals an additional $token parameter that is used to when generating $auth_cookie.

3.9

$auth_cookie = wp_generate_auth_cookie($user_id, $expiration, $scheme);
$logged_in_cookie = wp_generate_auth_cookie($user_id, $expiration, 'logged_in');

4.7.2

if ( '' === $token ) {
    $manager = WP_Session_Tokens::get_instance( $user_id );
    $token   = $manager->create( $expiration );
}

$auth_cookie = wp_generate_auth_cookie( $user_id, $expiration, $scheme, $token );
$logged_in_cookie = wp_generate_auth_cookie( $user_id, $expiration, 'logged_in', $token );

I am in the process of reporting the issue to the site owners. I have not been able to completely follow the newer (>3.9) PHP code and so would like some pointers as to whether the same type of cookie generation brute force attack is feasible on version 4.7.2?

2

Your question is about WP 4.7.2, but the current version is 4.8.1. Use the current version, always. My answer is for 4.8.1.

Simply put, the old hashing algorithm was md5 and the new algorithm uses sha256 (preferred) and sha1 if sha256 is not available.The updated code has increased the search space for brute forcing, which increases the time required to find a match. But, they are still generating these hashes based on predictable criteria.

So, yeah, brute forcing will now take longer (orders of magnitude longer), and under current computing power, it's probably computationally infeasible even though we are using predictable inputs.

WP 4.8 code for cookie generation

I'm not a fan of them using predictable material to generate this hash or the cookie, because it significantly reduces the search space. But, it's certainly better than it was. And, since the site is Wordpress, the only thing you can really do is keep it updated.

In looking at this code, by the way, it seems that they did not update the use of MD5 hashes elsewhere. Granted, hmac with salt is significantly more secure than just an MD5, but MD5 is very broken, and it seems to me that the computational cost of using SHA1 over MD5 is negligible. Not sure why they didn't update all hashes to at least SHA1 if not SHA256.

enter image description here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.