Pressbooks CAS Single Sign-On WP Registry grade B. Medium-severity findings · 2 findingsWP RegistryMedium-severity findings · 2 findingsOpen the reportB #2 in Users & Membership

Medium-severity findings.

Audited release

2.4.0

Findings

2

Worst severity

medium

Content hash

201203663a185dd8fd3eed5b… Copy

Findings

• medium CAS NetID matching uses unescaped LIKE wildcards and can log in the wrong WordPress user

  auth_bypass

  After phpCAS validates a ticket, matchUser() looks up pressbooks_cas_identity with SELECT user_id FROM usermeta WHERE meta_key = %s AND meta_value LIKE %s. The pattern is built as "{$net_id}|%" with no $wpdb->esc_like() (and no preg_quote of %/_). Identity rows are stored as "{net_id}|{unix_time}" by linkAccount(). WordPress $wpdb->prepare escapes quotes but not LIKE metacharacters, so a CAS principal containing '%' matches every linked user (get_var returns the first row, no ORDER BY) and '_' matches any single character (j_smith matches jasmith|<ts>; a_min matches admin|<ts>). handleLoginAttempt then calls programmatic_login() as that WP user without comparing the NetID as a literal. Realistic IdPs allow '_' in usernames; a '%' principal is enough for first-match takeover if the IdP (or a forged CAS response) will issue it. This is not SQL injection.

  inc/class-cas.php:424-431

  Recommendation

  Escape the NetID with $wpdb->esc_like() before wrapping it in the trailing % wildcard, e.g. $condition = $wpdb->esc_like( $net_id ) . '|%';. Prefer an exact prefix comparison (LIKE concat(esc_like(net_id), '|%')) or store NetID in its own meta/column and use '='. Do not use get_var without a deterministic ORDER BY if multiple rows can match.

• medium CAS ticket validation disables TLS certificate checks by default

  insecure_config

  CAS::__construct() calls phpCAS::setNoCasServerValidation() unless the PB_CAS_CERT_PATH environment variable is set. phpCAS 1.6.1 then performs the serviceValidate/proxyValidate HTTPS request with CURLOPT_SSL_VERIFYPEER=0 and CURLOPT_SSL_VERIFYHOST=0. There is no admin UI for a CA bundle; the insecure branch is the default for any stock install. A network attacker on the path between the WordPress server and the configured CAS host (a common topology: cloud-hosted Pressbooks validating against on-campus CAS) can intercept ticket validation and return a forged CAS XML success for an arbitrary NetID. handleLoginAttempt will then match or provision that identity and issue a WordPress session. phpCAS itself traces that this configuration 'is not recommended for production use.' README documents the env var but the plugin still ships the fail-open default.

  inc/class-cas.php:146-151

  Recommendation

  Default to phpCAS::setCasServerCACert() using the system CA store (or require PB_CAS_CERT_PATH). Do not call setNoCasServerValidation() in production builds. Expose the CA path as a network-admin setting with a warning, and refuse to enable CAS rather than silently disabling peer verification.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.