Exploiting authorization by nonce in WordPress plugins • Hacker News Board

Re: Exploiting authorization by nonce in WordPress plugins

#41

Post by ecjhdnc2025 » Thu, Aug 08, 2024, 6:03 PM UTC

nelse wrote: post #34

ecjhdnc2025 wrote: post #5

There is imprecision and conceptual forcing and there are sketchy constructs in this post that are annoying given its subject area. It is also shoehorning in other known vulnerability issues to pad out the article, when it is a pretty concise topic. I am not sure how widespread this specific nonce problem is. It definitely is a problem -- I am not disputing that. (Just as it's a problem that people have tended to ass…

Agree regarding Wordpress part connected to vulnerabilities. Fixed.

That's great :-)

Re: Exploiting authorization by nonce in WordPress plugins

#42

Post by dec0dedab0de » Thu, Aug 08, 2024, 7:33 PM UTC

progmetaldev wrote: post #40

dec0dedab0de wrote: post #24

Earlier quoted context omitted.

I think that is a valid stance to take by default, and maybe have the option to change it. If you force good passwords it really shouldn’t matter too much if the usernames can be enumerated.

Unless your users reuse passwords on other websites, then it is remarkably easy to enter a website. Increasing password complexity doesn't solve the issue with password reuse, and can often have users writing their passwords down on post-its around their desk/monitors.

Increasing complexity makes it harder to brute force hashed and salted passwords from a database. But yes if it is already leaked then you have a problem.

Though I would say that checking against haveIbeenpwnded or another service is a much better mitigation against that.

And 2fa is even better than both.

The truth of the matter is that the owners of most wordpress sites really do not care if it is hacked. Especially if they have a semi decent backup strategy. It is used in so many low stakes deployments that it is kind of silly to force certain levels of security.

Remember it is always about risk/reward. The most secure computer is the least usable one.

Re: Exploiting authorization by nonce in WordPress plugins

#43

Post by nightpool » Fri, Aug 09, 2024, 6:53 PM UTC

progmetaldev wrote: post #38

nightpool wrote: post #23

Earlier quoted context omitted.

After some thinking: I think a large part of the blame here also falls on the Wordpress documentation. It says that nonces should "never be used for authentication, authorization or access control", but it doesn't explain why. In actuality, nonces seem like they could be a very useful way to authenticate certain actions when a classic authentication session is not available (for example, when sending a user an email…

While I do completely agree with you, you also seem to have a much more advanced knowledge of Wordpress than the average developer. I obviously can only speak from my own experience, but to me it seems that Wordpress' popularity mostly revolves around the discoverability of its API, and most developers only consult the documentation when completely stuck on an issue that trial and error doesn't solve. My experience w…

I know next to nothing about WordPress and haven't used it since I was very little, these opinions just come from my general knowledge of web development, especially trained by my 5 years of Rails experience. Never underestimate the power of a good framework to illuminate the ways in which bad frameworks fail.

Re: Exploiting authorization by nonce in WordPress plugins

#44

Post by progmetaldev » Fri, Aug 09, 2024, 9:48 PM UTC

nightpool wrote: post #43

progmetaldev wrote: post #38

Earlier quoted context omitted.

While I do completely agree with you, you also seem to have a much more advanced knowledge of Wordpress than the average developer. I obviously can only speak from my own experience, but to me it seems that Wordpress' popularity mostly revolves around the discoverability of its API, and most developers only consult the documentation when completely stuck on an issue that trial and error doesn't solve. My experience w…

I know next to nothing about WordPress and haven't used it since I was very little, these opinions just come from my general knowledge of web development, especially trained by my 5 years of Rails experience. Never underestimate the power of a good framework to illuminate the ways in which bad frameworks fail.

Absolutely, most of my experience came from starting with MVC frameworks in PHP, Ruby, and .NET (of course after learning the language itself).

Re: Exploiting authorization by nonce in WordPress plugins

#45

Post by progmetaldev » Fri, Aug 09, 2024, 9:52 PM UTC

dec0dedab0de wrote: post #42

progmetaldev wrote: post #40

Earlier quoted context omitted.

Unless your users reuse passwords on other websites, then it is remarkably easy to enter a website. Increasing password complexity doesn't solve the issue with password reuse, and can often have users writing their passwords down on post-its around their desk/monitors.

Increasing complexity makes it harder to brute force hashed and salted passwords from a database. But yes if it is already leaked then you have a problem. Though I would say that checking against haveIbeenpwnded or another service is a much better mitigation against that. And 2fa is even better than both. The truth of the matter is that the owners of most wordpress sites really do not care if it is hacked. Especially…

I do agree, but with the popularity of Wordpress, I see more and more larger companies using it as a solution. I think the bigger issue is having the site penetrated, then silently serving up malware to your clients, than defacement or anything that would receive attention. I'm not familiar if there is a plugin or solution for integrating a password checking service with Wordpress. I know that it's not difficult to integrate with other CMS solutions.