Research Plan: CVE-2025-68051 Shiprocket IDOR

1. Vulnerability Summary

The Shiprocket plugin for WordPress (versions <= 2.0.8) contains an Insecure Direct Object Reference (IDOR) vulnerability. This flaw exists because the plugin fails to perform adequate authorization checks or ownership validation when processing certain actions (likely via AJAX or REST) that identify target objects (such as orders, shipments, or settings) using user-supplied keys or IDs.

An authenticated attacker with Subscriber-level permissions can exploit this to perform unauthorized actions, such as modifying shipping details, cancelling orders, or altering plugin configurations, depending on the specific vulnerable function.

2. Attack Vector Analysis

• Endpoint: WordPress AJAX (/wp-admin/admin-ajax.php) or a Shiprocket-specific REST API route.
• Vulnerable Action: Likely one of the following (inferred based on plugin functionality):
  • shiprocket_cancel_order
  • shiprocket_update_order_status
  • shiprocket_delete_account
  • shiprocket_save_settings
• Payload Parameter: A parameter such as id, order_id, shipment_id, or channel_id.
• Authentication: Authenticated, Subscriber level or higher.
• Preconditions: The attacker must have a valid Subscriber account and access to a valid nonce, which is typically exposed in the WordPress admin dashboard for all logged-in users.

3. Code Flow (Inferred)

1. Entry Point: The plugin registers an AJAX handler for authenticated users:
   add_action('wp_ajax_shiprocket_cancel_order', 'Shiprocket_Ajax_Handler::cancel_order'); (inferred).
2. Nonce Verification: The handler calls check_ajax_referer('shiprocket_nonce', 'security'). Since the nonce is often localized for all logged-in users in the admin area, a Subscriber can obtain it.
3. Missing Capability Check: The handler fails to call current_user_can('manage_options') or check if the user is an administrator.
4. Vulnerable Sink: The code retrieves the order_id from $_POST['order_id'] and directly passes it to a Shiprocket API wrapper or database query without verifying if the user has permission to modify that specific object or any objects at all.
   • Example: $result = $shiprocket_api->cancelOrder($_POST['order_id']);

4. Nonce Acquisition Strategy

Shiprocket likely enqueues its configuration and nonces for use in its admin dashboard. Even Subscribers can access basic admin pages like wp-admin/profile.php, which triggers the loading of global admin scripts.

1. Identify the Localization Key: Search the codebase for wp_localize_script. Look for a key like shiprocket_ajax_object or sr_admin_params.
2. Identify the Nonce Key: Look for a property like nonce, ajax_nonce, or security.
3. Automated Extraction:
   • Navigate to /wp-admin/profile.php as a Subscriber.
   • Execute: browser_eval("window.sr_admin_params?.nonce") (inferred key).

5. Exploitation Strategy

This plan assumes the vulnerability allows unauthorized order cancellation or status modification via IDOR.

1. Step 1: Authenticate as Subscriber: Login and maintain session cookies.
2. Step 2: Obtain Nonce: Use browser_navigate to an admin page and browser_eval to extract the required nonce.
3. Step 3: Identify Target ID: Find a target object ID (e.g., an order ID 123 created by an admin).
4. Step 4: Execute Unauthorized Action:
   • Use http_request to send a POST request to admin-ajax.php.
   • Action: shiprocket_cancel_order (inferred).
   • Parameters: action=shiprocket_cancel_order&order_id=123&security=[NONCE].

Draft HTTP Request:

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: localhost:8080
Content-Type: application/x-www-form-urlencoded
Cookie: [Subscriber Cookies]

action=shiprocket_cancel_order&order_id=123&security=[NONCE]

6. Test Data Setup

1. Administrative Setup:
   • Install Shiprocket plugin version 2.0.8.
   • Create a dummy WooCommerce order or a Shiprocket-managed order (ID: 123).
2. Attacker Setup:
   • Create a user with the Subscriber role.
3. Shortcode/Page Setup (If needed):
   • If the nonce is only available on specific pages, create a page with the Shiprocket dashboard shortcode: [shiprocket_dashboard] (inferred).

7. Expected Results

• Successful Exploit: The server returns a success response (e.g., {"success": true} or 1). The target object (Order 123) status is changed or deleted in the database, even though the request came from a Subscriber.
• Failed Exploit: The server returns 403 Forbidden or {"success": false, "data": "Unauthorized"}.

8. Verification Steps

1. Check Order Status via WP-CLI:
   wp post get 123 --field=post_status (Check if the status changed to 'cancelled').
2. Check Plugin Logs/Meta:
   wp post meta list 123 (Check for metadata updates indicating an external cancellation).
3. Verify Subscriber Permissions:
   Confirm the attacker user still only has the Subscriber role: wp user get [user_id] --field=roles.

9. Alternative Approaches

If shiprocket_cancel_order is not the vulnerable action:

• Search for all AJAX actions: grep -r "wp_ajax_" .
• Audit permissions: Check for any function that calls $_POST['id'] or $_POST['key'] and lacks a current_user_can check.
• Check REST API: Audit routes registered via register_rest_route. Look for handlers that lack a permission_callback or use __return_true.
• Check Settings Updates: A common IDOR allows updating API keys. Look for action=shiprocket_save_settings.