#5838 closed defect (bug) (fixed)
Make Nonce Mismatch Fail Instead of AYS
Reported by: | filosofo | Owned by: | |
---|---|---|---|
Milestone: | 2.5 | Priority: | normal |
Severity: | normal | Version: | 2.3.3 |
Component: | Security | Keywords: | nonce ays csrf css security has-patch |
Focuses: | Cc: |
Description
As the post here points out (I've duplicated his attack using my own 2.3.3 setup), you can make a CSRF attack that tricks a WordPress user into changing the admin password and emailing it to someone, by hiding all of the nonce confirmation except the "yes" submit button.
When the nonce doesn't match, my patch lets you know that the action has failed, and it provides a link back to the referring page so that you can try again.
Attachments (3)
Change History (13)
#2
@
17 years ago
- Milestone changed from 2.5 to 2.3.4
- Resolution fixed deleted
- Status changed from closed to reopened
#4
in reply to:
↑ 3
@
17 years ago
Replying to ryan:
Anyone want to port that to 2.3?
I've uploaded a patch for 2.3.3 tested and working on my install.
#5
@
17 years ago
A possible alternative would be to still show the AYS screen, not update the nonce, but require the user to enter his or her password (or username and password) to authenticate the request.
Pros: keeps the insurance we already have of not losing a POST request because of failed/expired nonce. That's a rare event. I think every time I've gotten an AYS it was because of bad code, not an expired nonce, so resubmitting by clicking yes didn't work anyway.
Cons: harder to code, needs to be audited, breaks the "deny, don't fix" security philosophy, is still open to social engineering CSRF if a user uses the same username/password pair on many sites. Such a CSRF attack could use a form like the following using similar techniques to the one above.
Sign up for the new hotness! username ____ password ____
... submit... Attack successful: those fields were actually the nonce AYS username/password fields. The user put their "tried and true" username/password pair into them.
Unrelatedly, a plugin can be written to fix this security issue. Just replace check_admin_referer() (it's pluggable).
Screenshot of new nonce mismatch failure message