WordPress.org

Make WordPress Core

Opened 6 years ago

Closed 6 years ago

Last modified 6 years ago

#5838 closed defect (bug) (fixed)

Make Nonce Mismatch Fail Instead of AYS

Reported by: filosofo Owned by:
Milestone: 2.5 Priority: normal
Severity: normal Version: 2.3.3
Component: Security Keywords: nonce ays csrf css security has-patch
Focuses: Cc:

Description

As the post here points out (I've duplicated his attack using my own 2.3.3 setup), you can make a CSRF attack that tricks a WordPress user into changing the admin password and emailing it to someone, by hiding all of the nonce confirmation except the "yes" submit button.

When the nonce doesn't match, my patch lets you know that the action has failed, and it provides a link back to the referring page so that you can try again.

Attachments (3)

nonce_fail.diff (10.0 KB) - added by filosofo 6 years ago.
nonce_failure.jpg (16.6 KB) - added by filosofo 6 years ago.
Screenshot of new nonce mismatch failure message
233_nonce_fix.diff (9.8 KB) - added by filosofo 6 years ago.

Download all attachments as: .zip

Change History (13)

filosofo6 years ago

filosofo6 years ago

Screenshot of new nonce mismatch failure message

comment:1 ryan6 years ago

  • Resolution set to fixed
  • Status changed from new to closed

(In [6813]) Make Nonce Mismatch Fail Instead of AYS. Props filosofo. fixes #5838 for 2.5

comment:2 ryan6 years ago

  • Milestone changed from 2.5 to 2.3.4
  • Resolution fixed deleted
  • Status changed from closed to reopened

comment:3 follow-up: ryan6 years ago

Anyone want to port that to 2.3?

comment:4 in reply to: ↑ 3 filosofo6 years ago

Replying to ryan:

Anyone want to port that to 2.3?

I've uploaded a patch for 2.3.3 tested and working on my install.

filosofo6 years ago

comment:5 mdawaffe6 years ago

A possible alternative would be to still show the AYS screen, not update the nonce, but require the user to enter his or her password (or username and password) to authenticate the request.

Pros: keeps the insurance we already have of not losing a POST request because of failed/expired nonce. That's a rare event. I think every time I've gotten an AYS it was because of bad code, not an expired nonce, so resubmitting by clicking yes didn't work anyway.

Cons: harder to code, needs to be audited, breaks the "deny, don't fix" security philosophy, is still open to social engineering CSRF if a user uses the same username/password pair on many sites. Such a CSRF attack could use a form like the following using similar techniques to the one above.

 Sign up for the new hotness!
 username ____
 password ____

... submit... Attack successful: those fields were actually the nonce AYS username/password fields. The user put their "tried and true" username/password pair into them.

Unrelatedly, a plugin can be written to fix this security issue. Just replace check_admin_referer() (it's pluggable).

comment:6 ryan6 years ago

(In [6817]) Add a prophylactic specialchars to the object in explain nonce. see #5838

comment:7 ryan6 years ago

I'm fine with just die-ing. wp_nonce_ays() has caused enough pain. :-)

comment:8 ryan6 years ago

  • Resolution set to fixed
  • Status changed from reopened to closed

(In [6818]) Make Nonce Mismatch Fail Instead of AYS. Props filosofo. fixes #5838 for 2.3

comment:9 ryan6 years ago

  • Milestone changed from 2.3.4 to 2.9

Milestone 2.3.4 deleted

comment:10 westi6 years ago

  • Milestone changed from 2.9 to 2.5
Note: See TracTickets for help on using tickets.