Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Exploiting authorization by nonce in WordPress plugins

nowotarski.info

Post reply on HN
Print view View original

11–20 of 45 posts

Re: Exploiting authorization by nonce in WordPress plugins

#11

Post by cloudking »

bubblebeard wrote: post #8

This reminds me of an article in which brute forcing the WP admin panel was discussed. The problem was that when supplying inaccurate user credentials you would get an error message telling you which was wrong. Their dev stated this was a design choice, that you needed to balance security and user friendlyness. Security in WP seems more like an afterthought to me, which is a shame to say the least.

Yep, I've found fail2ban wired to NGINX logs is a good solution against brute force and DDoS attacks on my WordPress sites.

Re: Exploiting authorization by nonce in WordPress plugins

#12

Post by savolai »

bubblebeard wrote: post #8

This reminds me of an article in which brute forcing the WP admin panel was discussed. The problem was that when supplying inaccurate user credentials you would get an error message telling you which was wrong. Their dev stated this was a design choice, that you needed to balance security and user friendlyness. Security in WP seems more like an afterthought to me, which is a shame to say the least.

It can indeed be incredibly confusing for users if that is not disclosed, bordering on hostile.

It is a common pattern to reregister i.e. when in a hurry so you end up with multiple ids. If you also have userids in addition to email addresses, it can easily become a hard problem in itself to solve/remember which email/pw corresponds to which userid. Obfuscating user/password error messages can make this much worse.

Techies often forget what a messy world non-engineers live in.

Isn’t NOT disclosing that security by obscurity?

Re: Exploiting authorization by nonce in WordPress plugins

#14

Post by kevindamm »

zarzavat wrote: post #7
kevindamm wrote: post #6

Earlier quoted context omitted.

That definition was made after the sense being used in this article (and this sense has been widely used in cybersecurity in general). Your linked term comes from an acronym written on prison cell doors (Not On Normal Courtyard Exercise) while the meaning of "used only once / unique" has an etymology dating back to Middle English.

“Slut” originally means an untidy woman but if you call someone that, a knowledge of etymology is not going to help. Language doesn’t work based on precedent.

I'm not talking about precedent -- the comment was that it was a poor choice of term, implying that the term in the article came about later.. when the uniqueness sense of the word has been in use since long before that.

Though the slang word looks like it originated in '71 and the cybersecurity use of it only goes back to '78, so perhaps it was a poor choice indeed. Though, with its similarity to the use by dictionary editors and cartographers, it makes sense why they would pick that term.

I only today became aware of the pedophilia reference for it and will have a difficult time unthinking thoughts of revulsion whenever I encounter the security-related term, but what can you do.

Re: Exploiting authorization by nonce in WordPress plugins

#15

Post by kevindamm »

phpnode wrote: post #9
kevindamm wrote: post #6

Earlier quoted context omitted.

That definition was made after the sense being used in this article (and this sense has been widely used in cybersecurity in general). Your linked term comes from an acronym written on prison cell doors (Not On Normal Courtyard Exercise) while the meaning of "used only once / unique" has an etymology dating back to Middle English.

that's likely a backronym

I did a little more digging and it seems you're probably right about that.

Re: Exploiting authorization by nonce in WordPress plugins

#17

Post by fullspectrumdev »

ecjhdnc2025 wrote: post #5

There is imprecision and conceptual forcing and there are sketchy constructs in this post that are annoying given its subject area. It is also shoehorning in other known vulnerability issues to pad out the article, when it is a pretty concise topic. I am not sure how widespread this specific nonce problem is. It definitely is a problem -- I am not disputing that. (Just as it's a problem that people have tended to ass…

> 280 9.0+ vulnerabilities in seventy thousand plugins, the long tail of which have maybe dozens of activations at most.

This actually is a great point. A few years ago when working on a code analysis tool, we mirrored every single WP plugin and let it chew on them for a while.

It used a mixture of static and dynamic analysis, and “kinda worked” to some extent.

It found more issues than we could reasonably handle, and a lot of them were in plugins with maybe two installs ever and that hadn’t been activated in years.

We ran out of beans before implementing a proper triage system that would score the findings based on popularity or “last updated” data.

I may revisit this sometime though, as my ideas on static and dynamic analysis have come a long way since then!

Re: Exploiting authorization by nonce in WordPress plugins

#18

Post by throwaway2016a »

bubblebeard wrote: post #8

This reminds me of an article in which brute forcing the WP admin panel was discussed. The problem was that when supplying inaccurate user credentials you would get an error message telling you which was wrong. Their dev stated this was a design choice, that you needed to balance security and user friendlyness. Security in WP seems more like an afterthought to me, which is a shame to say the least.

It's not quite so clear cut. Close. Even OWASP acknowledges there are trade offs:

> The problem with returning a generic error message for the user is a User Experience (UX) matter. A legitimate user might feel confused with the generic messages, thus making it hard for them to use the application, and might after several retries, leave the application because of its complexity. The decision to return a generic error message can be determined based on the criticality of the application and its data. [1]

Though it's a pretty low bar. Given the common uses of Wordpress, there is certainly a very strong argument that it warrants the extra security.

I'm not defending its UX, I think it should have more generic errors. Just pointing out that this one particular example is not in and of itself the best banner to hold up when it comes to bad security as it is not a clear cut answer. A person could be very considerate of security and still come to the conclusion that the better UX is worth the risk.

[1] https://cheatsheetseries.owasp.org/cheatsheets/Authenticatio...

Re: Exploiting authorization by nonce in WordPress plugins

#19

Post by SketchySeaBeast »

savolai wrote: post #12
bubblebeard wrote: post #8

This reminds me of an article in which brute forcing the WP admin panel was discussed. The problem was that when supplying inaccurate user credentials you would get an error message telling you which was wrong. Their dev stated this was a design choice, that you needed to balance security and user friendlyness. Security in WP seems more like an afterthought to me, which is a shame to say the least.

It can indeed be incredibly confusing for users if that is not disclosed, bordering on hostile. It is a common pattern to reregister i.e. when in a hurry so you end up with multiple ids. If you also have userids in addition to email addresses, it can easily become a hard problem in itself to solve/remember which email/pw corresponds to which userid. Obfuscating user/password error messages can make this much worse. T…

It makes it so much easier for attackers - they then can know that a user has an account there too, and can then use that information to find that user's other known passwords. It's offering up information the attacker might not have.

Re: Exploiting authorization by nonce in WordPress plugins

#20

Post by throwaway2016a »

SketchySeaBeast wrote: post #19
savolai wrote: post #12

Earlier quoted context omitted.

It can indeed be incredibly confusing for users if that is not disclosed, bordering on hostile. It is a common pattern to reregister i.e. when in a hurry so you end up with multiple ids. If you also have userids in addition to email addresses, it can easily become a hard problem in itself to solve/remember which email/pw corresponds to which userid. Obfuscating user/password error messages can make this much worse. T…

It makes it so much easier for attackers - they then can know that a user has an account there too, and can then use that information to find that user's other known passwords. It's offering up information the attacker might not have.

While I agree it's not really security through obscurity because when combined with other strategies (like mitigating timing attacks and rate limiting) it does expose less information to the attacker.

However, I stand that it does depend on the application. For example: Facebook does not use generic error messages. I presume because there are other trivial ways to find out if a user has an account so mitigating enumeration through the login form is not actually adding extra security.

Post reply on HN