What are the vulnerabilities of exposing url end point param?

Question

I have a wordpress plugin that helps create an organization chart/tree and then generates a URL where the chart is available to be viewed by the public?

Inside the plugin's view in WordPress dashboard. After we create a chart, we click generate URL button to generate URL. The URL generated is: wordpressExampleApp.com/{key}. Whenever a request comes we grab the key and check if it's the same as our db. The function for key validation is like this:

public function does_url_have_valid_key() {
        return isset( $_GET['key'] ) && ( empty( $_GET['key'] ) || $_GET['key'] === $this->key() );
    }

Is there any security vulnerability like direct object access or injection that this implementation is exposed to? I mean we never sanitized what's passed in the get request and directly check it, I have been asked to do a security vulnerability audit for this implementation. I'm learning securing applications so my question may be missing details, please let me know if you need any information to be added to the question.

Note: the key is generated using the wp_generate_password function and the key function definition is:

public function regenerate_key() {
        update_option( self::OPTION_NAME, wp_generate_password( 8 ) );
    }

    public function key() {
        return get_option( self::OPTION_NAME ) ?: 'secret';
    }

Answer 1

Exposing this parameter is not a vulnerability. According to Kerckhoffs's principle you should assume that an attacker knows your API well.

Your description shows at leas one vulnerability: You store the key in the database as is. If the attacker gets access to it, it can use keys for unauthorized access.

What can you do to prevent it? Use password hashing.

You use keys of length 8 which means entropy of about 48 bits. Depending on the costs of consequences of a successful attack this may be sufficient, may be not. Depending on this you may want to increase entropy to 92 or more bits, which means key length of at least 15 characters.

There can be other factors not directly related to the API. For instance, if you write requests to a log, this can increase the risk that the attacker retrieves the keys.

Answer 2

In general you need to follow the approach that any parameter of your URL query could be exploit to the next types of attacks:

• SQL Injections
• XSS attacks
• Remote command executions
• Binary exploits

Probably I miss any others :)