constant cache_page_secret in regolith

Disclosed: 2016-12-30 04:48:13 By e3amn2l To iandunn-projects
Unknown
Vulnerability Details
in: https://github.com/iandunn/regolith/blob/master/config/plugins/wp-super-cache.php#L28 ``` $cache_page_secret = 'ad270361c39c428c9465313363b02559'; ``` there usage of static $cache_page_secret, as regolith is installation template. it's better to generate the secret for each installation instead of using static known value. knowledge of $cache_page_secret value can be used to send requests which will not pass though the caching: https://github.com/Automattic/wp-super-cache/blob/ea592c1d2796d0bc5c343322923c5f8bb40a0066/wp-cache-phase1.php#L32 thus enable more effective DOS (denial of service) attacks as the caching mechanism is disabled. fix: generate the $cache_page_secret in safe way once per installation & store the value in needed configuration file.
Actions
View on HackerOne
Report Stats
  • Report ID: 185914
  • State: Closed
  • Substate: resolved
  • Upvotes: 7
Share this report