HexBrain

Ian Dunn · Report #185914

constant cache_page_secret in regolith

Validstatus
$25bounty
7upvotes
30 Dec 2016disclosed

How it was found

in: https://github.com/iandunn/regolith/blob/master/config/plugins/wp-super-cache.php#L28

$cache_page_secret             = 'ad270361c39c428c9465313363b02559';

there usage of static $cache_page_secret, as regolith is installation template. it's better to generate the secret for each installation instead of using static known value. knowledge of $cache_page_secret value can be used to send requests which will not pass though the caching: https://github.com/Automattic/wp-super-cache/blob/ea592c1d2796d0bc5c343322923c5f8bb40a0066/wp-cache-phase1.php#L32 thus enable more effective DOS (denial of service) attacks as the caching mechanism is disabled.

fix: generate the $cache_page_secret in safe way once per installation & store the value in needed configuration file.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original