Make WordPress Core

Opened 17 years ago

Closed 17 years ago

Last modified 16 years ago

#5838 closed defect (bug) (fixed)

Make Nonce Mismatch Fail Instead of AYS

Reported by: filosofo's profile filosofo Owned by:
Milestone: 2.5 Priority: normal
Severity: normal Version: 2.3.3
Component: Security Keywords: nonce ays csrf css security has-patch
Focuses: Cc:

Description

As the post here points out (I've duplicated his attack using my own 2.3.3 setup), you can make a CSRF attack that tricks a WordPress user into changing the admin password and emailing it to someone, by hiding all of the nonce confirmation except the "yes" submit button.

When the nonce doesn't match, my patch lets you know that the action has failed, and it provides a link back to the referring page so that you can try again.

Attachments (3)

nonce_fail.diff (10.0 KB) - added by filosofo 17 years ago.
nonce_failure.jpg (16.6 KB) - added by filosofo 17 years ago.
Screenshot of new nonce mismatch failure message
233_nonce_fix.diff (9.8 KB) - added by filosofo 17 years ago.

Download all attachments as: .zip

Change History (13)

@filosofo
17 years ago

@filosofo
17 years ago

Screenshot of new nonce mismatch failure message

#1 @ryan
17 years ago

  • Resolution set to fixed
  • Status changed from new to closed

(In [6813]) Make Nonce Mismatch Fail Instead of AYS. Props filosofo. fixes #5838 for 2.5

#2 @ryan
17 years ago

  • Milestone changed from 2.5 to 2.3.4
  • Resolution fixed deleted
  • Status changed from closed to reopened

#3 follow-up: @ryan
17 years ago

Anyone want to port that to 2.3?

#4 in reply to: ↑ 3 @filosofo
17 years ago

Replying to ryan:

Anyone want to port that to 2.3?

I've uploaded a patch for 2.3.3 tested and working on my install.

#5 @mdawaffe
17 years ago

A possible alternative would be to still show the AYS screen, not update the nonce, but require the user to enter his or her password (or username and password) to authenticate the request.

Pros: keeps the insurance we already have of not losing a POST request because of failed/expired nonce. That's a rare event. I think every time I've gotten an AYS it was because of bad code, not an expired nonce, so resubmitting by clicking yes didn't work anyway.

Cons: harder to code, needs to be audited, breaks the "deny, don't fix" security philosophy, is still open to social engineering CSRF if a user uses the same username/password pair on many sites. Such a CSRF attack could use a form like the following using similar techniques to the one above.

 Sign up for the new hotness!
 username ____
 password ____

... submit... Attack successful: those fields were actually the nonce AYS username/password fields. The user put their "tried and true" username/password pair into them.

Unrelatedly, a plugin can be written to fix this security issue. Just replace check_admin_referer() (it's pluggable).

#6 @ryan
17 years ago

(In [6817]) Add a prophylactic specialchars to the object in explain nonce. see #5838

#7 @ryan
17 years ago

I'm fine with just die-ing. wp_nonce_ays() has caused enough pain. :-)

#8 @ryan
17 years ago

  • Resolution set to fixed
  • Status changed from reopened to closed

(In [6818]) Make Nonce Mismatch Fail Instead of AYS. Props filosofo. fixes #5838 for 2.3

#9 @ryan
16 years ago

  • Milestone changed from 2.3.4 to 2.9

Milestone 2.3.4 deleted

#10 @westi
16 years ago

  • Milestone changed from 2.9 to 2.5
Note: See TracTickets for help on using tickets.