Research Plan: CVE-2026-40784 FluentBoards IDOR

1. Vulnerability Summary

The FluentBoards plugin (<= 1.91.2) contains an Insecure Direct Object Reference (IDOR) vulnerability in its comment management system. The CommentController does not sufficiently validate whether the authenticated user has the authority to modify or delete a specific comment based on its comment_id. While the API requires a board_id in the URL, it fails to verify if the provided comment_id actually belongs to that board or if the user is the author/administrator of that comment. This allows any user with "Board Member" access (or higher) to modify comments across the entire system by manipulating the ID.

2. Attack Vector Analysis

• Endpoint: POST /wp-json/fluent-boards/v1/boards/{board_id}/comments/{comment_id}
• Method: POST (used for updates in the Fluent framework)
• Authentication: Required (User must have at least "Board Member" permissions within the plugin).
• Vulnerable Parameter: {comment_id} in the REST URL.
• Payload Parameter: comment (string) containing the new comment text.
• Preconditions:
  • The attacker must be logged in.
  • The attacker must be a member of at least one Board (to access the API).
  • The attacker needs to know the ID of the comment they wish to modify.

3. Code Flow

1. Entry Point: The request hits the REST API route associated with CommentController@update.
2. Controller Logic (app/Http/Controllers/CommentController.php):
   • The update method (truncated in provided source, but visible at line 147) receives $board_id and $comment_id from the URL.
   • It calls $this->commentSanitizeAndValidate() to process the comment body.
   • It attempts to update the comment via $this->commentService->update($commentData, $comment_id).
3. Missing Check: There is no logic in the controller to verify:
   • That the comment identified by $comment_id belongs to the board identified by $board_id.
   • That the current user is the owner of the comment or a Board Administrator.
4. Sink: The database is updated with the new comment content regardless of ownership.

4. Nonce Acquisition Strategy

FluentBoards uses the standard WordPress REST API nonce. It is localized in the admin dashboard.

1. Identify Trigger: The FluentBoards dashboard is located at /wp-admin/admin.php?page=fluent-boards.
2. Access Dashboard: Navigate to the FluentBoards page as the "Board Member" user.
3. Extract Nonce: Use browser_eval to extract the nonce from the window.FluentBoardsAdmin global object.
   • JS Key: window.FluentBoardsAdmin.nonce
4. Alternative: The standard REST nonce wp_rest might also work if passed in the X-WP-Nonce header.

5. Exploitation Strategy

Step 1: Data Gathering

Identify the Target Comment ID. For this PoC, we will create a comment as a "Victim" user and capture its ID.

Step 2: Perform the IDOR Update

Use the http_request tool to send a spoofed update request.

• URL: http://localhost:8080/wp-json/fluent-boards/v1/boards/{ATTACKER_BOARD_ID}/comments/{VICTIM_COMMENT_ID}
• Method: POST
• Headers:
  • Content-Type: application/json
  • X-WP-Nonce: {EXTRACTED_NONCE}
  • Cookie: {ATTACKER_SESSION_COOKIES}
• Payload:

  {
    "comment": "This comment has been modified by an unauthorized user.",
    "mentionData": []
  }
  

6. Test Data Setup

1. Users:
   • victim_user (Subscriber role)
   • attacker_user (Subscriber role)
2. Boards:
   • Victim Board (ID: 1): victim_user added as "Admin".
   • Attacker Board (ID: 2): attacker_user added as "Member".
3. Content:
   • A task created on Victim Board.
   • A comment created by victim_user on that task (Target ID: X).
4. Plugin Configuration: Ensure both users are assigned their respective boards via the FluentBoards interface.

7. Expected Results

• The server returns a 200 OK or 201 Created response.
• The response JSON contains the updated comment object with the new description.
• The comment ID in the response matches {VICTIM_COMMENT_ID}.

8. Verification Steps

1. Check via CLI:

   wp db query "SELECT description FROM wp_fboards_comments WHERE id = {VICTIM_COMMENT_ID}"
   

2. Confirm Content: Verify the description matches the string: "This comment has been modified by an unauthorized user.".
3. Ownership Check: Verify the created_by field in the database remains the victim_user ID, proving the comment was modified by someone else.

9. Alternative Approaches

• IDOR Deletion: If an update vulnerability exists, a delete vulnerability often exists at the same level.
  • Endpoint: DELETE /wp-json/fluent-boards/v1/boards/{attacker_board_id}/comments/{victim_comment_id}
• Board Settings IDOR: Check if BoardController::modifyAuthenticationPermission (line 309 in BoardService.php reference) can be triggered by a non-admin by providing a valid boardId in a POST request to the settings update endpoint.
• Task IDOR: Attempt to move a task from a victim board to an attacker board by changing the board_id and stage_id in a task update request. (Check TaskController.php).