REST API calls that should be blocked are allowed

  • mrboats

    (@wpseiskaadmin)


    2 years, 10 months ago

    I noticed a couple of REST API calls that I think should have been blocked but that were passed by Cerber. In the hardening settings all namespaces except 1 are blocked but still I see some REST calls from not-logged-in users being passed also to other namespaces. Most calls are blocked as should, but these spurious misses are a bit worrisome, especially as user enumeration seems to have been at least one of the cases.

    Running the latest version of Cerber (8.9.5).

    Here are a couple of slips: screenshot 1

    Here are my current settings: screenshot 2

Viewing 6 replies - 1 through 6 (of 6 total)

  • Hi mrboats
    I have had the same problem for a long time on all my sites where WordPress is installed in a sub folder and the WordPress Address (URL) is not the same as the Site Address (URL). Looking at your screenshot I am guessing you have the same configuration. I ended up using another method to block the REST API on those sites. The calls appear to be correctly blocked on the one site I have where WordPress is installed in the root.

    Thread Starter mrboats

    (@wpseiskaadmin)

    In my case, WordPress is in the root.

    Plugin Author gioni

    (@gioni)

    Please confirm that you can reproduce the issue by manually sending a request from your browser with the same not blocked REST API URL.

    Thread Starter mrboats

    (@wpseiskaadmin)

    That is the challenge here that these seems spurious and I cannot see any pattern. As I said, mostly the REST calls get blocked as should but then there are these random occurrences that get passed through incorrectly.

    In the case where WordPress is installed in a sub folder and the WordPress Address (URL) is not the same as the Site Address (URL) the following are not blocked at all, and show all information, from a not logged in browser on a not white listed IP:
    https://example.com/wp-json/wp/v2/
    https://example.com/wp-json/wp/v2/users
    In fact I think all REST API requests starting with wp-json are not blocked.
    I have the following REST API settings on Cerber 8.9.5:
    “Stop user enumeration”, “Disable REST API” and “Logged-in users” all turned on.
    “Allow REST API for these roles” and “Allow these namespaces” are both empty.

    I am wondering if mrboats problem URLs start with http: as shown in his screenshot rather than the normal https:

    Thread Starter mrboats

    (@wpseiskaadmin)

    @dabrolga, true that, hadn’t paid attention so that detail. So seems that http: might be the culprit here. @gioni, shouldn’t http requests be blocked as well?

Viewing 6 replies - 1 through 6 (of 6 total)
  • The topic ‘REST API calls that should be blocked are allowed’ is closed to new replies.

Tags