BUG: access_token with admin rights for all?

  • Resolved harchvertelol

    (@harchvertelol)


    4 years, 3 months ago

    I found a big error (sort of). Actions:

    1) We log in in the standard way, get an access token and a refresh token for the ‘test ‘ user.
    Request body:
    {“username”: “test”, “password”: “123”}
    2) I make a request for /wp-json/wp/v2/users/me and get the user test. Fine!
    3) I take the refresh token, call /wp-json/api-bearer-auth/v1/tokens/refresh without header. I am not putting authentication in the header. I get a new access token.
    Request body:
    {“token”: “… refresh token …”}
    4) I take the received new access token, put it in the authorization header and call /wp-json/wp/v2/users/me again. I get the ‘admin’ user. admin has id = 1.

    This is definitely a very serious bug. It turns out that any user can get administrative rights simply by having a refresh token.

    WordPress 5.4.2
    API Bearer 20200717

    Also change user password not set access and refresh tokens to invalid

    Me using postman for tests.

Viewing 6 replies - 1 through 6 (of 6 total)
  • Thread Starter harchvertelol

    (@harchvertelol)

    I checked MySQL DB:
    call Bearer API for refresh token refresh access token for admin and test users (maybe, for all users?).

    Update: yes, for all user in it table.

    Thread Starter harchvertelol

    (@harchvertelol)

    Okay, I checked source code of plugin (db.php), and we have:

    $wpdb->query($wpdb->prepare(“UPDATE ” . $wpdb->base_prefix . “user_tokens
    SET access_token = %s,
    access_token_valid = %s”, $token[‘token’], $token[‘expires_datetime’]))

    This query not containg ‘WHERE’, and we have update all users tokens.

    Thread Starter harchvertelol

    (@harchvertelol)

    Please, fix it. You should add ‘… WHERE user_id = %d’ … $user_id

    UPDATE:

    Working fix:

    if ($wpdb->query($wpdb->prepare(“UPDATE ” . $wpdb->base_prefix . “user_tokens
    SET access_token = %s,
    access_token_valid = %s WHERE user_id = %d”, $token[‘token’], $token[‘expires_datetime’], $user_id)))

    Plugin Author michielve

    (@michielve)

    Hi,

    Thanks for letting me know this bug exists and your time to find the solution for this!

    I released a new version (20200807) with the fix in it.

    Best wishes,
    Michiel

    Thread Starter harchvertelol

    (@harchvertelol)

    Thank you very much for your quick response!

    What about setting tokens to invalid, when change password?

    P. S. How I can set, that topic is solved?

    • This reply was modified 4 years, 3 months ago by harchvertelol.
    Plugin Author michielve

    (@michielve)

    Hi,

    I’ve set this topic to resolved.

    I’m not sure if tokens should be invalidated when the password is changed. See for example: https://www.developsec.com/2016/07/25/should-password-change-invalidate-all-access-tokens/. I tend to follow his argumentation.

    If you have valid arguments for the idea that tokens should be invalidated after a password change, please open a new topic and I will reconsider.

    Best wishes,
    Michiel

Viewing 6 replies - 1 through 6 (of 6 total)
  • The topic ‘BUG: access_token with admin rights for all?’ is closed to new replies.