Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Exploiting authorization by nonce in WordPress plugins

nowotarski.info

Post reply on HN
Print view View original

31–40 of 45 posts

Re: Exploiting authorization by nonce in WordPress plugins

#31

Post by bubblebeard »

dec0dedab0de wrote: post #24
bubblebeard wrote: post #8

This reminds me of an article in which brute forcing the WP admin panel was discussed. The problem was that when supplying inaccurate user credentials you would get an error message telling you which was wrong. Their dev stated this was a design choice, that you needed to balance security and user friendlyness. Security in WP seems more like an afterthought to me, which is a shame to say the least.

I think that is a valid stance to take by default, and maybe have the option to change it. If you force good passwords it really shouldn’t matter too much if the usernames can be enumerated.

To me it’s needless exposure for admin accounts. I can see the value for frontend, client, accounts. However, only if such a service use usernames and not email addresses for logins. Otherwise it would be a great way for attackers to accumelate email addresses related to certain types of services.

Re: Exploiting authorization by nonce in WordPress plugins

#32

Post by rsynnott »

kevindamm wrote: post #6
francis-io wrote: post #2

Unfortunate naming... https://dictionary.cambridge.org/dictionary/english/nonce

That definition was made after the sense being used in this article (and this sense has been widely used in cybersecurity in general). Your linked term comes from an acronym written on prison cell doors (Not On Normal Courtyard Exercise) while the meaning of "used only once / unique" has an etymology dating back to Middle English.

> Your linked term comes from an acronym written on prison cell doors (Not On Normal Courtyard Exercise)

These are _always_ backronyms. _Always_. If anyone ever tells you that [random word that's been around for a while] is an acronym, they are _wrong_. (Possible notable exception for 'fubar'; that one's old enough now and probably really is an acronym).

Re: Exploiting authorization by nonce in WordPress plugins

#33

Post by claudiulodro »

bubblebeard wrote: post #8

This reminds me of an article in which brute forcing the WP admin panel was discussed. The problem was that when supplying inaccurate user credentials you would get an error message telling you which was wrong. Their dev stated this was a design choice, that you needed to balance security and user friendlyness. Security in WP seems more like an afterthought to me, which is a shame to say the least.

WordPress doesn't consider usernames as a secret[1], so under that logic it is totally fine to say whether a username exists when trying to log in.

[1] https://core.trac.wordpress.org/ticket/20235#comment:7

Re: Exploiting authorization by nonce in WordPress plugins

#34

Post by nelse »

ecjhdnc2025 wrote: post #5

There is imprecision and conceptual forcing and there are sketchy constructs in this post that are annoying given its subject area. It is also shoehorning in other known vulnerability issues to pad out the article, when it is a pretty concise topic. I am not sure how widespread this specific nonce problem is. It definitely is a problem -- I am not disputing that. (Just as it's a problem that people have tended to ass…

Agree regarding Wordpress part connected to vulnerabilities. Fixed.

Re: Exploiting authorization by nonce in WordPress plugins

#35

Post by kevindamm »

rsynnott wrote: post #32
kevindamm wrote: post #6

Earlier quoted context omitted.

That definition was made after the sense being used in this article (and this sense has been widely used in cybersecurity in general). Your linked term comes from an acronym written on prison cell doors (Not On Normal Courtyard Exercise) while the meaning of "used only once / unique" has an etymology dating back to Middle English.

> Your linked term comes from an acronym written on prison cell doors (Not On Normal Courtyard Exercise) These are _always_ backronyms. _Always_. If anyone ever tells you that [random word that's been around for a while] is an acronym, they are _wrong_. (Possible notable exception for 'fubar'; that one's old enough now and probably really is an acronym).

Yeah I shouldn't have assumed that was right, even if it seemed more likely than "nonsense" and especially since I'm not very familiar with UK slang.

It seems the exception is those terms with origins in military and academia.

Re: Exploiting authorization by nonce in WordPress plugins

#36

Post by multjoy »

kevindamm wrote: post #14
zarzavat wrote: post #7

Earlier quoted context omitted.

“Slut” originally means an untidy woman but if you call someone that, a knowledge of etymology is not going to help. Language doesn’t work based on precedent.

I'm not talking about precedent -- the comment was that it was a poor choice of term, implying that the term in the article came about later.. when the uniqueness sense of the word has been in use since long before that. Though the slang word looks like it originated in '71 and the cybersecurity use of it only goes back to '78, so perhaps it was a poor choice indeed. Though, with its similarity to the use by dictiona…

Imagine the delight we had over the fantastically named Nonce Finance.

Re: Exploiting authorization by nonce in WordPress plugins

#37

Post by multjoy »

mikrl wrote: post #29
francis-io wrote: post #2

Unfortunate naming... https://dictionary.cambridge.org/dictionary/english/nonce

The preferred spelling of nonse is n-o-n-S-e although c-e is an acceptable ethnic variant. Source: originally come from a time and place where you call your friends one for a laugh (and shout it at actual ones you know from cars)

It’s always been nonce. Source: have used it since the eighties.

Re: Exploiting authorization by nonce in WordPress plugins

#38

Post by progmetaldev »

nightpool wrote: post #23
nightpool wrote: post #22

I'm not sure I really understand the weight this article gives to "nonces"—from an outside perspective, it seems like writing an titled "Exploiting authorization via cookie on Google.com" when you've found a simple XSS. In each case, the problem isn't the nonce itself, but rather the fact that developers are 1) allowing arbitrary file uploads with insecure sanitization, 2) embedding a secret value in frontend JSON bl…

After some thinking: I think a large part of the blame here also falls on the Wordpress documentation. It says that nonces should "never be used for authentication, authorization or access control", but it doesn't explain why. In actuality, nonces seem like they could be a very useful way to authenticate certain actions when a classic authentication session is not available (for example, when sending a user an email…

While I do completely agree with you, you also seem to have a much more advanced knowledge of Wordpress than the average developer. I obviously can only speak from my own experience, but to me it seems that Wordpress' popularity mostly revolves around the discoverability of its API, and most developers only consult the documentation when completely stuck on an issue that trial and error doesn't solve.

My experience with Wordpress is more around general PHP security, and reviewing compromised websites to determine whether a cleanup and patch is possible, rather than dumping it and starting over. I'm not sure if improving the documentation and making the API more secure (while also adding some complexity) would fix the vulnerabilities you suggest, or if it would turn less experienced developers away from using Wordpress in the first place. I'm a big fan of adding logging code to user defined functions, to make it easier to get a higher level view of what code is actually executing in a running website.

If you haven't considered it before, and aren't currently involved in it, reviewing Wordpress codebases for vulnerabilities can be pretty lucrative and challenging in an enjoyable way (assuming those you consult with take your advice). Regardless, you seem to be in the small number of vocal developers that might be able to bring about that type of change, for what it's worth.

Re: Exploiting authorization by nonce in WordPress plugins

#39

Post by progmetaldev »

bubblebeard wrote: post #8

This reminds me of an article in which brute forcing the WP admin panel was discussed. The problem was that when supplying inaccurate user credentials you would get an error message telling you which was wrong. Their dev stated this was a design choice, that you needed to balance security and user friendlyness. Security in WP seems more like an afterthought to me, which is a shame to say the least.

While not with Wordpress, I've had this conversation multiple times with both management where I'm employed, as well as with client management. I always give pushback when it comes to logins, forgotten passwords, and registrations. Telling someone that a username/email or password is wrong just halved the work needed to break into a system, if not more (since having a username or email correct, with an incorrect password, could allow further social engineering).

For a forgotten password where an email is entered, I always send back a success message. I understand that humans type their emails incorrectly, but allowing a user to enter an email address and seeing a message stating the email wasn't found has now just become a way for an attacker to discover what emails are registered with a website. From there, social engineering becomes much easier, as well as brute forcing ONLY a password and not an email/password combination.

I understand that the complexity in this is due to human frustration, rather than a technology problem. Probably one of the more complex problems to solve. I wish I could paste over these issues by writing more code.

Re: Exploiting authorization by nonce in WordPress plugins

#40

Post by progmetaldev »

dec0dedab0de wrote: post #24
bubblebeard wrote: post #8

This reminds me of an article in which brute forcing the WP admin panel was discussed. The problem was that when supplying inaccurate user credentials you would get an error message telling you which was wrong. Their dev stated this was a design choice, that you needed to balance security and user friendlyness. Security in WP seems more like an afterthought to me, which is a shame to say the least.

I think that is a valid stance to take by default, and maybe have the option to change it. If you force good passwords it really shouldn’t matter too much if the usernames can be enumerated.

Unless your users reuse passwords on other websites, then it is remarkably easy to enter a website. Increasing password complexity doesn't solve the issue with password reuse, and can often have users writing their passwords down on post-its around their desk/monitors.
Post reply on HN