Writing Secure Plugins — WordCamp New York 2009

Writing Secure Plugins

Mark Jaquith

@markjaquithmarkjaquith.com

coveredwebservices.com

Saturday, November 14, 2009

XSSCSRFSQL injection

privilege escalation

shell execution


Plugin security is hit-or-miss


Mostly miss


SQL Injection


<?php$wpdb->query( "UPDATE $wpdb->posts SET post_title = '$newtitle' WHERE ID = $my_id" );?>


<?php$newtitle = esc_sql( $newtitle );$my_id = absint( $my_id );

$wpdb->query( "UPDATE $wpdb->posts SET post_title = '$newtitle' WHERE ID = $my_id" );?>


$wpdb->update()


<?php$wpdb->update( $wpdb->posts, array( 'post_title' => $newtitle ), array( 'ID' => $my_id ) );?>


$wpdb->insert()


<?php$wpdb->insert( $wpdb->posts, array( 'post_title' => $newtitle ) );?>


<?php$wpdb->update( $wpdb->posts, array( 'post_title' => $newtitle, 'post_content' => $newcontent ), array( 'ID' => $my_id, 'post_title' => $old_title ) );?>


<?php$post_title = 'New Title';$wheres['ID'] = 123;$wheres['post_title'] = 'Old Title';$wpdb->update( $wpdb->posts, compact( 'post_title' ), $wheres );?>


$wpdb->prepare()


<?php$title = 'Post Title';$ID = 123;$content = $wpdb->get_var( $wpdb->prepare( "SELECT post_content FROM $wpdb->posts WHERE post_title = %s AND ID = %d", $title, $ID ) );?>


•Uses sprintf() formatting

•%s for strings

•%d for integers

•You should not quote or escape


Escapelate


XSSSaturday, November 14, 2009

<h1><?php echo $title;?></h1>


<?php $title = '<script> pwnage(); </script>'?>

<h1><?php echo $title;?></h1>


Anything that isn’t hardcoded

is suspect


Better:Everything is suspect



esc_html()


<?php $title = '<script> pwnage(); </script>'?><h1><?php echo esc_html( $title );?></h1>


<?php$title = '" onmouseover="pwnd();';?><a href="#wordcamp" title="<?php echo $title;?>">Link Text</a>


esc_attr()


<?php$title = '" onmouseover="pwnd();';?><a href="#wordcamp" title="<?php echo esc_attr( $title );?>">Link Text</a>


<?php $url = 'javascript:pwnage();';?><a href="<?php echo esc_attr( $url );?>">Link Text</a>

WRONG


esc_url()


<?php $url = 'javascript:pwnage();';?><a href="<?php echo esc_url( $url );?>">Link Text</a>


esc_url_raw(), sister of esc_url()


esc_ js()


<script>var foo = '<?php echo esc_js( $bar ); ?>';</script>


CSRFSaturday, November 14, 2009

Authorizationvs.

IntentionSaturday, November 14, 2009

Noncesaction-, object-,

user-specific time limited secret keys


Specific to •WordPress user

•Action attempted

•Object of attempted action

•Time window


wp_nonce_field()


<form action="process.php" method="post"><?php wp_nonce_field('plugin-action_object');?>

...</form>


check_admin_referer( )


<?php// before output goes to browsercheck_admin_referer('plugin- action_object');?>


Still need to use current_user_can()


AJAXCSRF


• wp_create_nonce( 'your_action' );

• &_ajax_nonce=YOUR_NONCE

• check_ajax_referer( 'your_action' );


Privilege Escalation


current_user_can()


Set your salts!http://api.wordpress.org/secret-key/1.1/


Stupid shit I see all the time


exec()


<form action="<?php echo $_SERVER['REQUEST_URI']; ?>">


<a href="<?php echo $url; ?>" title="<?php echo $title; ?>"><?php echo $text; ?></a>

<script>var foo = '<?php echo $js; ?>';</script>


<a href="<?php echo esc_url( $url ); ?>" title="<?php echo esc_attr( $title ); ?>"><?php echo esc_html( $text ); ?></a>

<script>var foo = '<?php echo esc_js( $js ); ?>';</script>


Discussion


Technology

Writing Secure Plugins — WordCamp New York 2009