constant cache_page_secret in regolith
Unknown
Vulnerability Details
in:
https://github.com/iandunn/regolith/blob/master/config/plugins/wp-super-cache.php#L28
```
$cache_page_secret = 'ad270361c39c428c9465313363b02559';
```
there usage of static $cache_page_secret, as regolith is installation template. it's better to generate the secret for each installation instead of using static known value.
knowledge of $cache_page_secret value can be used to send requests which will not pass though the caching:
https://github.com/Automattic/wp-super-cache/blob/ea592c1d2796d0bc5c343322923c5f8bb40a0066/wp-cache-phase1.php#L32
thus enable more effective DOS (denial of service) attacks as the caching mechanism is disabled.
fix:
generate the $cache_page_secret in safe way once per installation & store the value in needed configuration file.
Actions
View on HackerOneReport Stats
- Report ID: 185914
- State: Closed
- Substate: resolved
- Upvotes: 7