WordPress Plugin Quick Playground 1.3.1 REST API Authorization Bypass via Insecure Permission Callback

漏洞概述 该网页截图显示了 WordPress 插件目录中的文件 ，其中存在一个安全漏洞。该漏洞涉及 REST API 请求的处理，具体表现为在获取蓝图（Blueprints）和克隆帖子（Cloning Posts）时，未正确验证用户权限，从而导致潜在的安全风险。 影响范围 受影响插件：Quick Playground 受影响版本：1.3.1 影响功能：REST API 请求处理，特别是获取蓝图和克隆帖子的功能。 修复方案 1. 权限验证：在 方法中，确保对所有 REST API 请求进行严格的权限验证。 2. 输入清理：对所有用户输入进行严格的清理和验证，防止恶意输入导致的安全问题。 3. 更新插件：建议用户尽快将 Quick Playground 插件更新至最新版本，以修复已知的安全漏洞。 POC代码 以下是截图中包含的 POC 代码： ```php class Gckly_Clone_Settings extends WP_REST_Controller { / Registers REST API routes for cloning posts. / public function register_routes() { $namespace = 'quickplayground/v1'; $path = '/clone/settings/(?P[a-z0-9_-]+)'; register_rest_route($namespace, $path, [ 'methods' => 'GET', 'callback' => array($this, 'get_items'), 'permission_callback' => array($this, 'get_items_permissions_check') ]); } / Permissions check for getting items. @param WP_REST_Request $request The REST request. @return bool True if allowed. / public function get_items_permissions_check($request) { return true; } / Handles GET requests for cloning posts and related data. @param WP_REST_Request $request The REST request. @return WP_REST_Response The response object. */ public function get_items($request) { require_once('common.php'); global $wpdb; $gckly_directories = gckly_get_directories(); $gckly_site_uploads = gckly_directories()['site_uploads']; $gckly_uploads = gckly_directories()['uploads']; $gckly_uploads_url = gckly_directories()['uploads_url']; $gckly_site_uploads_url = gckly_directories()['site_uploads_url']; $profile = sanitize_text_field($request['profile']); $clone['profile'] = $profile; $settings = get_option('quickplayground_clone_settings_' . $profile . '_array'); $settings['timestamp_string'] = get_option('timestamp_string'); $blog_id = get_current_blog_id(); $blogusers = get_users(); $array = [ 'blog_id' => $blog_id, 'blog_url' => get_bloginfo('url'), 'blog_name' => get_bloginfo('name'), 'blog_description' => get_bloginfo('description'), 'blog_charset' => get_bloginfo('charset'), 'blog_language' => get_bloginfo('language'), 'blog_timezone' => get_bloginfo('timezone_string'), 'blog_date_format' => get_option('date_format'), 'blog_time_format' => get_option('time_format'), 'blog_start_of_week' => get_option('start_of_week'), 'blog_users' => $blogusers, 'blog_users_count' => count($blogusers), 'blog_users_array' => $blogusers, 'blog_users_array_count' => count($blogusers), 'blog_users_array_keys' => array_keys($blogusers), 'blog_users_array_values' => array_values($blogusers), 'blog_users_array_items' => array_map(function($user) { return [ 'ID' => $user->ID, 'user_login' => $user->user_login, 'user_nicename' => $user->user_nicename, 'user_email' => $user->user_email, 'user_url' => $user->user_url, 'user_registered' => $user->user_registered, 'user_activation_key' => $user->user_activation_key, 'user_status' => $user->user_status, 'display_name' => $user->display_name, ]; }, $blogusers), 'blog_users_array_items_count' => count(array_map(function($user) { return [ 'ID' => $user->ID, 'user_login' => $user->user_login, 'user_nicename' => $user->user_nicename, 'user_email' => $user->user_email, 'user_url' => $user->user_url, 'user_registered' => $user->user_registered, 'user_activation_key' => $user->user_activation_key, 'user_status' => $user->user_status, 'display_name' => $user->display_name, ]; }, $blogusers)), 'blog_users_array_items_keys' => array_keys(array_map(function($user) { return [ 'ID' => $user->ID, 'user_login' => $user->user_login, 'user_nicename' => $user->user_nicename, 'user_email' => $user->user_email, 'user_url' => $user->user_url, 'user_registered' => $user->user_registered, 'user_activation_key' => $user->user_activation_key, 'user_status' => $user->user_status, 'display_name' => $user->display_name, ]; }, $blogusers)), 'blog_users_array_items_values' => array_values(array_map(function($user) { return [ 'ID' => $user->ID, 'user_login' => $user->user_login, 'user_nicename' => $user->user_nicename, 'user_email' => $user->user_email, 'user_url' => $user->user_url, 'user_registered' => $user->user_registered, 'user_activation_key' => $user->user_activation_key, 'user_status' => $user->user_status, 'display_name' => $user->display_name, ]; }, $blogusers)), 'blog_users_array_items_values' => array_values(array_map(function($user) { return [ 'ID' => $user->ID, 'user_login' => $user->user_login, 'user_nicename' => $user->user_nicename, 'user_email' => $user->user_email, 'user_url' => $user->user_url, 'user_registered' => $user->user_registered, 'user_activation_key' => $user->user_activation_key, 'user_status' => $user->user_status, 'display_name' => $user->display_name, ];

目標達成 すべての支援者に感謝 — 100%達成しました！

WordPress Plugin Quick Playground 1.3.1 REST API Authorization Bypass via Insecure Permission Callback

目標達成すべての支援者に感謝 — 100%達成しました！