Aruba HiSpeed Cache < 3.0.3 - Missing Authorization

This research plan focuses on identifying and exploiting a Missing Authorization vulnerability in the Aruba HiSpeed Cache plugin (versions < 3.0.3). This vulnerability allows unauthenticated attackers to trigger sensitive actions (likely cache purging or settings modification) due to the absence of capability checks.

---

1. Vulnerability Summary

• Vulnerability: Missing Authorization (CWE-862).
• Component: Aruba HiSpeed Cache plugin (slug: aruba-hispeed-cache).
• Affected Versions: < 3.0.3.
• Root Cause: The plugin registers AJAX handlers using the wp_ajax_nopriv_ hook but fails to implement current_user_can() checks within the callback functions. This exposes administrative functionality to unauthenticated users.

2. Attack Vector Analysis

• Endpoint: http://<target>/wp-admin/admin-ajax.php
• Method: POST
• Action: (Inferred) The vulnerability likely involves an action like aruba_hispeed_cache_purge, purge_all_cache, or similar cache-clearing functions.
• Required Parameters:
  • action: The specific AJAX action name.
  • nonce: (Optional/Inferred) The nonce variable if the handler uses check_ajax_referer.
• Preconditions: The plugin must be active. Some actions might require the cache to be enabled in settings.

3. Code Flow Analysis (Targeting wp_ajax_nopriv_)

1. Hook Registration: Search for add_action( 'wp_ajax_nopriv_...' ) in the plugin source (likely in the main file or an admin/AJAX class).
   • Candidate File: aruba-hispeed-cache/aruba-hispeed-cache.php or aruba-hispeed-cache/includes/class-aruba-hispeed-cache.php.
2. Handler Execution: When a POST request hits admin-ajax.php with the corresponding action, WordPress executes the registered callback function.
3. Vulnerable Sink: Inside the callback, the code performs a privileged operation (e.g., calling a method that deletes files in wp-content/cache/ or updates a database option) without verifying the user's role or checking for administrative privileges.

4. Nonce Acquisition Strategy

If the handler performs a nonce check (e.g., check_ajax_referer( 'aruba-hispeed-cache-nonce', ... )), the nonce must be retrieved from the frontend.

1. Identify Localization: Search for wp_localize_script in the plugin code to find where the nonce is passed to the frontend.
   • Search Pattern: grep -r "wp_localize_script" .
2. Locate JS Variable: Look for the object name and key (e.g., aruba_cache_object.nonce).
3. Script Triggering: Determine which page/shortcode loads the script. Caching plugins often load scripts on all public pages or specific dashboard pages.
4. Retrieval Method:
   • Navigate to the homepage: browser_navigate("http://localhost:8080").
   • Extract the nonce: browser_eval("window.aruba_hispeed_cache_vars?.nonce") (inferred variable name).

5. Exploitation Strategy

The goal is to trigger the unauthorized action (e.g., purging the cache) via an unauthenticated request.

• Step 1: Identify Action Name
  Execute grep -rn "wp_ajax_nopriv_" . to find the available unauthenticated actions.
• Step 2: Construct the Request
  Using the http_request tool, send a POST request:
  • URL: http://localhost:8080/wp-admin/admin-ajax.php
  • Headers: Content-Type: application/x-www-form-urlencoded
  • Body: action=[ACTION_NAME]&nonce=[NONCE_VALUE] (Add other parameters discovered in the handler).
• Step 3: Analyze Response
  A successful exploit typically returns a 200 OK with a body like {"success":true} or 1.

6. Test Data Setup

1. Install Plugin: Ensure aruba-hispeed-cache < 3.0.3 is installed and active.
2. Enable Cache: Navigate to the plugin settings and enable caching so there is data to purge.
3. Generate Cache Files: Visit various pages on the site to ensure the wp-content/cache/aruba-hispeed-cache/ (or similar) directory is populated.

7. Expected Results

• Unauthorized Access: The request to admin-ajax.php succeeds despite no login cookies being provided.
• Cache Invalidation: The server-side cache files are deleted or the cache version/timestamp in the wp_options table is updated.
• Response Body: {"success":true} or a similar success indicator.

8. Verification Steps

After sending the HTTP request, verify the impact using WP-CLI:

1. Check Cache Directory: wp eval "echo is_dir(WP_CONTENT_DIR . '/cache/aruba-hispeed-cache') ? 'Exists' : 'Deleted';" or list files to see if they were cleared.
2. Check Options: If the action updates a setting, check the value: wp option get aruba_hispeed_cache_settings.
3. Check Logs: If the plugin logs purges, check for a new entry triggered at the time of the exploit.

9. Alternative Approaches

• Settings Overwrite: If the missing authorization is in a settings update handler (e.g., wp_ajax_nopriv_save_settings), attempt to change the "Cache Timeout" or "Exclude URL" settings to disrupt site performance.
• Nonce Bypass: If check_ajax_referer is used with die=false (a common mistake), try the request without a nonce or with an invalid one.
• REST API: Check if the plugin registers any REST routes (register_rest_route) with 'permission_callback' => '__return_true' or missing the callback entirely.