Detection Guidance

This vulnerability can be detected by monitoring HTTP requests to the /wp-json/pos-bridge/ REST API endpoints for the presence of the 'OliverAuth' header with the value '0'. An unauthenticated request containing the header 'OliverAuth: 0' indicates an attempt to exploit the authorization bypass.

You can use command-line tools like curl or network monitoring tools to check for such requests.

• Using curl to test the vulnerability: curl -H "OliverAuth: 0" https://your-wordpress-site.com/wp-json/pos-bridge/
• Using tcpdump or Wireshark to filter HTTP requests containing 'OliverAuth: 0' header.

Useful 0 Not Useful 0

Executive Summary

The Oliver POS WooCommerce Point of Sale plugin for WordPress has a vulnerability called Authorization Bypass Through User-Controlled Key in all versions up to 2.4.2.6.

The plugin protects its REST API endpoints using a permission callback that compares an attacker-supplied 'OliverAuth' header value against a stored authorization token using a loose PHP comparison (==).

On fresh installations where the admin has not completed the connection flow, the stored token is unset (false). Due to PHP type juggling, the comparison '0' == false evaluates to true.

This allows an unauthenticated attacker to bypass authentication by sending the header 'OliverAuth: 0', granting full access to all POS API endpoints.

Useful 0 Not Useful 0

Impact Analysis

An attacker exploiting this vulnerability can gain full access to all POS API endpoints without authentication.

• Read user data, including administrator details.
• Update user profiles, including changing email addresses.
• Delete non-admin users.

By resetting an admin account's email, an attacker can potentially take over the entire site.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows unauthenticated attackers to bypass authentication and gain full access to all POS API endpoints, enabling them to read user data including administrator details, update user profiles including email addresses, and delete non-admin users.

Such unauthorized access and potential data manipulation can lead to exposure or alteration of personal and sensitive information, which may violate data protection requirements under standards like GDPR and HIPAA.

Additionally, the possibility of an admin account email reset leading to site takeover increases the risk of further unauthorized data access and control.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include updating the Oliver POS plugin to a version later than 2.4.2.6 where this vulnerability is fixed.

If an update is not immediately possible, restrict access to the /wp-json/pos-bridge/ REST API namespace by implementing firewall rules or web server access controls to block unauthorized requests.

Additionally, monitor logs for suspicious requests containing the 'OliverAuth: 0' header and investigate any unauthorized access.

Useful 0 Not Useful 0