Distributor: Insufficient permission checks for External Connection Post Type

Reported by @lichoin

Summary

The editing and creation of external (REST API) connections in Distributor contain insufficient permission checks on the edit screen.

This allows users with the edit_post permission (Contributors +) to access the "New External Connection" screen to obtain the nonce required for the following AJAX actions:

• dt_verify_external_connection
• dt_begin_authorization

Cause

The issue is caused by a combination of errors with the registration and editing of the external connection CPT.

The creation and editing of the CPT is is intended to be limited to uses with the manage_options (this can be modified with the filter dt_external_capabilities). However the post type itself is registered using the default post capability in Distributor\ExternalConnectionCPT\setup_cpt().

While both Distributor\ExternalConnectionCPT\ajax_verify_external_connection() and Distributor\ExternalConnectionCPT\ajax_begin_authorization() include nonce checks via check_ajax_referer() they lack permission checks that the users have the permission to permissions to manage_options.

Impact

All users with the edit_post permission (Contributors +) can visit the "Create New External Connection" screen to obtain the nonce used for the AJAX endpoints above.

With this nonce they can craft AJAX requests to trigger the following.

• leak authentication details to attacker controlled servers: using enumeration and well crafted AJAX requests users with edit_post can trigger requests containing authentication details to arbitrary web servers.
• trigger the authentication process to attacker controlled servers: this can be used to cause the server to make requests to third party servers

Recommendations

Upgrade to Distributor 2.3.2

References:

• GHSA-pxgv-j98h-3xhw
• https://github.com/10up/distributor/commit/71542b924fdd446a4183f32b928388d286ae5bb3
• Version 2.3.2