From 623e325f3647a63fd962702e693234f0abb5c7b1 Mon Sep 17 00:00:00 2001 From: Lee Maguire Date: Mon, 22 Dec 2025 11:42:50 +0000 Subject: [PATCH 1/2] Avoid fatal errors by checking POST validity An attacker is currently attempting to find vulnerabilites on our sites. Fatal errors are being generated via 2fa via `wp-login.php` ``` PHP Fatal error: Uncaught TypeError: trim(): Argument #1 ($string) must be of type string, array given in /var/www/html/wp-includes/pluggable.php:686 Stack trace: #0 /var/www/html/wp-includes/pluggable.php(686): trim() #1 /var/www/html/wp-content/plugins/2fa/lib/login.php(168): wp_authenticate() #2 /var/www/html/wp-includes/class-wp-hook.php(341): {closure}() #3 /var/www/html/wp-includes/class-wp-hook.php(365): WP_Hook->apply_filters() #4 /var/www/html/wp-includes/plugin.php(522): WP_Hook->do_action() #5 /var/www/html/wp-login.php(571): do_action() #6 {main} thrown in /var/www/html/wp-includes/pluggable.php on line 686 ``` This is happening because POST variables are being presented as arrays but processed using string-only functions. We should be checking for strings before using user-supplied values like this. --- lib/login.php | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/lib/login.php b/lib/login.php index 7992f7b..a46ea9e 100644 --- a/lib/login.php +++ b/lib/login.php @@ -163,7 +163,7 @@ function twofa_wp_set_auth_cookie($user_id, $rememberme) // Phase 1 - if (isset($_POST['log']) && isset($_POST['pwd'])) { + if (isset($_POST['log']) && is_string($_POST['log']) && isset($_POST['pwd']) && is_string($_POST['pwd'])) { // Verify credentials $user = wp_authenticate($_POST['log'], $_POST['pwd']); @@ -191,7 +191,9 @@ function twofa_wp_set_auth_cookie($user_id, $rememberme) // Phase 2 - if (isset($_POST['token']) && isset($_POST['user_id']) && isset($_POST['nonce'])) { + if (isset($_POST['token']) && is_string($_POST['token']) && + isset($_POST['user_id']) && is_string($_POST['user_id']) && + isset($_POST['nonce']) && is_string($_POST['nonce'])) { $user_id = absint($_POST['user_id']); if ($user_id <= 0) { @@ -201,7 +203,8 @@ function twofa_wp_set_auth_cookie($user_id, $rememberme) if (twofa_bruteforce_login_show_captcha($user_id)) { $recaptcha = new \ReCaptcha\ReCaptcha(RECAPTCHA_PRIVATE_KEY); - $resp = $recaptcha->verify(stripslashes($_POST['g-recaptcha-response']), $_SERVER['REMOTE_ADDR']); + $g_recaptcha_response = (isset($_POST['g-recaptcha-response']) && is_string($_POST['g-recaptcha-response'])) ? $_POST['g-recaptcha-response'] : ''; + $resp = $recaptcha->verify(stripslashes($g_recaptcha_response), $_SERVER['REMOTE_ADDR']); if (!$resp->isSuccess()) { $errors->add('invalid_captcha', __('Invalid CAPTCHA. Try again.')); $render(2, $errors, null, $user_id); From de7adb67a7e8bf45c4eb605a6aa31cc188febd80 Mon Sep 17 00:00:00 2001 From: Lee Maguire Date: Mon, 22 Dec 2025 12:58:56 +0000 Subject: [PATCH 2/2] Also validation check for redirect_to ``` PHP Warning: Array to string conversion in /var/www/html/wp-includes/formatting.php on line 1128 "GET /wp-login.php?reauth=1&redirect_to[%24ne]=https://accessibility.blog.gov.uk/wp-admin/ HTTP/1.1" ``` --- lib/login.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/login.php b/lib/login.php index a46ea9e..e4de297 100644 --- a/lib/login.php +++ b/lib/login.php @@ -3,7 +3,7 @@ // Gets the filtered value of the redirect_to parameter (string) // Taken from wp-login.php $get_redirect_to = function ($user) { - if (isset($_REQUEST['redirect_to'])) { + if (isset($_REQUEST['redirect_to']) && is_string($_REQUEST['redirect_to'])) { $redirect_to = $_REQUEST['redirect_to']; // // Redirect to https if user wants ssl // if ( $secure_cookie && false !== strpos($redirect_to, 'wp-admin') ) { // @@ -13,7 +13,7 @@ $redirect_to = admin_url(); } - $requested_redirect_to = isset($_REQUEST['redirect_to']) ? $_REQUEST['redirect_to'] : ''; + $requested_redirect_to = (isset($_REQUEST['redirect_to']) && is_string($_REQUEST['redirect_to'])) ? $_REQUEST['redirect_to'] : ''; return apply_filters('login_redirect', $redirect_to, $requested_redirect_to, $user); };