WP Manifestindependent plugin directory
manifest / security / disciple-tools-advanced-security

Disciple Tools - Advanced Security WP RegistryHigh-severity findings · 1 findingOpen the reportC-

Advanced view of activity log and writing activity to file or Elasticsearch for use in security auditing. Especially useful if monitoring multiple instances.

by cairocoder01 · github.com/cairocoder01/disciple-tools-advanced-security · website

★ 1stars
163release downloads
≈10active sites
v0.3.2latest · 4 years ago

Install

Download disciple-tools-advanced-security.zip From the v0.3.2 release on GitHub, May 4, 2022

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/cairocoder01/disciple-tools-advanced-security/releases/download/v0.3.2/disciple-tools-advanced-security.zip
Updates itself. It ships its own updater (Plugin Update Checker), so new versions appear under Dashboard → Updates.
Readme github.com/cairocoder01/disciple-tools-advanced-security ↗

Advanced Security banner

Disciple Tools Advanced Security

The Disciple Tools Advanced Security Plugin is intended to facilitate advanced security audits of activity on your Disciple.Tools site. It adds and admin view of the D.T activity log (to admin users only) and enables writing select activity logs to a line-delimited JSON log file for ingestion into external security audit tools.

Activity Logs

All logging comes directly from Disciple.Tools' activity logging process. As such, a number of new activity logs are added in order to also log those actions to file for security auditing.

New Activity Logs

  • User
    • Failed login attempts
    • Password reset
    • New user creation
    • Add/Remove user roles
    • Add/Remove user from sites
    • Grant/Revoke super admin
    • Delete user
  • Plugins
    • Activate/Deactivate plugin
    • Delete plugin
    • Update plugin
  • Core
    • Upgrade WordPress

Elasticsearch permissions

It is best to create a separate role which can then be assigned to a user. Here are the required permissions :

  • cluster privileges
    • monitor
  • index privileges
    • indices : your-dt-logs
    • privileges
      • create_doc
      • create_index (not strictly necessary if you have created the index or don't use time based indexes)
      • monitor

File Logging Filter

Not all activity logs should be saved out to file as some are part of the normal operation of the system. As a result, a filtering process is run every time an activity log is saved to check if it should be saved to file.

By default, the follow types of activity are saved to file:

  • action = export
  • object_type = core
  • object_type = plugin
  • object_type = theme
  • object_type = site_link_system
  • object_type = User

Additional activity can be logged to file using the filter dt_advanced_security_activity_included:

add_filter( 'dt_advanced_security_activity_included', 'my_filter', 10, 2 );
function my_filter( $include, $args ) {
  return $include || $args['object_type'] == 'my_post_type';
}

Contributing

Getting Started

  • Install Composer packages: composer install
  • Initialize git hooks: vendor/bin/cghooks add
    • This will run PHPCS code linting prior to each commit

Submitting Updates

  1. Before submitting any code, ensure lint rules all pass: composer run lint
  2. Run composer run lint-fix to automatically fix as much as possible
  3. Submit pull request with detailed description of the need and function of the added/changed code
  4. If CI build fails, fix errors and push code so it can be reviewed

Releases

7 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v0.3.2 latest
May 4, 2022 4 years ago
disciple-tools-advanced-security.zip
98
v0.3.1
Dec 15, 2020 5 years ago
disciple-tools-advanced-security.zip
27
v0.3.0
Dec 10, 2020 5 years ago
disciple-tools-advanced-security.zip
10
v0.2.2
Dec 9, 2020 5 years ago
disciple-tools-advanced-security.zip
6
v0.2.1
Dec 8, 2020 5 years ago
disciple-tools-advanced-security.zip
6
v0.2.0
Dec 7, 2020 5 years ago
disciple-tools-advanced-security.zip
8
v0.1.0
Dec 2, 2020 5 years ago
disciple-tools-advanced-security.zip
8

Active-site estimate ≈10 comes from the median of recent superseded releases. Method.

C- grade

Security

Disciple Tools - Advanced Security 0.3.2 · audited by WP Registry

High-severity findings.

1 high
Audited release
0.3.2
Findings
1
Worst severity
high
Content hash
08f2b5eba56b56623cc82a0b…

Findings

  • high Security activity logs written under the plugin directory are world-readable over HTTP

    information_disclosure

    DT_Advanced_Security_File_Logger::get_log_path() hardcodes WP_PLUGIN_DIR/disciple-tools-advanced-security/logs/. When a manage_dt user enables Log to File, log_activity() mkdir()s that path with mode 0777 (no index.php, no .htaccess deny) and appends json_encode($args) to activity.log; files over 100MB rotate to activity.N.log with no maximum count. The Settings screen even displays the path from /wp-content onward. Default filters (dt_advanced_security_activity_included) persist failed logins (attacker-chosen username plus hist_ip from X-Forwarded-For), password_reset and password_reset_request, user create/delete/role/site/super-admin events, plugin/theme/core updates, exports, and site_link_system activity. Those events are exactly what this plugin exists to capture. On a default Apache/nginx WordPress layout the web server serves the files with no cookie or capability check, so any unauthenticated client who knows the plugin slug can read other users' authentication and IAM audit data and enumerate installed plugins. Observable: with dt_advanced_security_file_logger enabled, curl https://site/wp-content/plugins/disciple-tools-advanced-security/logs/activity.log returns NDJSON lines after a failed wp-login.php POST. World-writable 0777 also lets another local user on shared hosting plant files in a web-executable tree.

    logger/file-logger.php:19-75

    Recommendation

    Do not store audit logs under a web-reachable directory. Write to a path outside the document root (or to wp-content/uploads/<random>/ with an Apache/nginx deny and an empty index.php), create the directory as 0750, and deny HTTP access to *.log. Cap rotated file count. Until patched, disable Log to File or block /wp-content/plugins/disciple-tools-advanced-security/logs/ at the web server.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →