0

I have a wordpress plugin that helps create an organization chart/tree and then generates a URL where the chart is available to be viewed by the public?

Inside the plugin's view in WordPress dashboard. After we create a chart, we click generate URL button to generate URL. The URL generated is: wordpressExampleApp.com/{key}. Whenever a request comes we grab the key and check if it's the same as our db. The function for key validation is like this:

public function does_url_have_valid_key() {
        return isset( $_GET['key'] ) && ( empty( $_GET['key'] ) || $_GET['key'] === $this->key() );
    }

Is there any security vulnerability like direct object access or injection that this implementation is exposed to? I mean we never sanitized what's passed in the get request and directly check it, I have been asked to do a security vulnerability audit for this implementation. I'm learning securing applications so my question may be missing details, please let me know if you need any information to be added to the question.

Note: the key is generated using the wp_generate_password function and the key function definition is:

public function regenerate_key() {
        update_option( self::OPTION_NAME, wp_generate_password( 8 ) );
    }

    public function key() {
        return get_option( self::OPTION_NAME ) ?: 'secret';
    }

2 Answers 2

1

Exposing this parameter is not a vulnerability. According to Kerckhoffs's principle you should assume that an attacker knows your API well.

Your description shows at leas one vulnerability: You store the key in the database as is. If the attacker gets access to it, it can use keys for unauthorized access.

What can you do to prevent it? Use password hashing.

You use keys of length 8 which means entropy of about 48 bits. Depending on the costs of consequences of a successful attack this may be sufficient, may be not. Depending on this you may want to increase entropy to 92 or more bits, which means key length of at least 15 characters.

There can be other factors not directly related to the API. For instance, if you write requests to a log, this can increase the risk that the attacker retrieves the keys.

4
  • How is that SQL can't be injected here? Can't the attacker do something like 'wordpressExampleApp.com/drop table' ? May 16 at 8:47
  • You don't show any code related to database. That's why it is impossible to say anything about SQL injection.
    – mentallurg
    May 16 at 11:34
  • get_option() is a WordPress hook that gets data from DB, it's used in the key() function to get the key May 16 at 11:44
  • self::OPTION_NAME is a constant that does not depend on the user input. That's why an SQL injection in the expression get_option( self::OPTION_NAME ) is impossible.
    – mentallurg
    May 16 at 17:00
0

In general you need to follow the approach that any parameter of your URL query could be exploit to the next types of attacks:

  • SQL Injections
  • XSS attacks
  • Remote command executions
  • Binary exploits

Probably I miss any others :)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.