[wp-trac] [WordPress Trac] #53830: Default filters try to create nonce during installation before options table exists

[WordPress Trac]

#53830: Default filters try to create nonce during installation before options
table exists
-------------------------------------------------+-------------------------
 Reporter:  schlessera                           |       Owner:
                                                 |  SergeyBiryukov
     Type:  defect (bug)                         |      Status:  closed
 Priority:  normal                               |   Milestone:  5.8.1
Component:  Upgrade/Install                      |     Version:  5.7
 Severity:  normal                               |  Resolution:  fixed
 Keywords:  good-first-bug has-test-info has-    |     Focuses:
  patch commit fixed-major                       |
-------------------------------------------------+-------------------------

Comment (by juliobox):

 For information, and this is not a security issue (not exploitable), you
 can add ?user_id=99 to any page that enqueued 'user-profile' JS handle,
 the userProfileL10n will create the nonce based on this parameter.
 It seems that you created a nonce for another user, but it's not since
 your own ID is also added to the nonce, so the check will fail.
 Still, this is strange to add a user_id in the nonce action because it's
 useless. Nonces always have added the user_id, duplicates it and it's not
 more secure.
 Well, now we know that we can do that, still not exploitable.
 ps : If you want to test it, follow these steps:
 1/ Ask for a reset password.
 2/ Open you mailbox, copy the link
 3/ Paste it and add "&user_id=99"
 4/ Show source code of the page and look for "userProfileL10n"
 5/ You're reading the (unusable) nonce for user 99.

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/53830#comment:13>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform