WP-CRON Leading to a Complete Denial of Service (DoS) for Bank ‘X’

Complete Denial Of Service (DoS) for Bank ‘X’

Hello, Infosec Community!
I am Guru Prasad Pattanaik, also known online as “TH3N00BH4CK3R.” Today, I want to share my experience of finding a vulnerability on a banking site belonging to one of our clients. This issue led to a complete Denial of Service (DoS) Attack, disrupting their online services. I aim to raise awareness about the risks associated with unoptimized configurations and provide insights into how organizations can mitigate such vulnerabilities.

The Bank site was using WordPress

Many WordPress-based systems rely on wp-cron.php to schedule background tasks like publishing scheduled posts, sending emails, and clearing caches. However, improper configuration or overreliance on this script can lead to severe performance issues, especially when exposed to the public Internet without restrictions.

While browsing Bank ‘X’s website, I noticed some performance inconsistencies. Upon further inspection, I observed that wp-cron.php was enabled. I got curious and decided to dig deeper into the issue.

Identifying the Endpoint: I found that the wp-cron.php file was publicly accessible at https://bankx.com/wp-cron.php.Triggering the Issue: By repeatedly sending requests to this endpoint, I observed that the server’s response times began to degrade significantly.Impact Analysis: When subjected to a moderate level of automated traffic, the script caused the entire website to become unresponsive, resulting in a complete Denial of Service (DoS).The site was down and giving this error

The root cause was that wp-cron.php was not properly protected or optimized. The script would process each incoming request without any validation, which led to resource exhaustion. This made the endpoint vulnerable to both intentional and unintentional abuse.

Denial Of Service (DoS) Attack

I suggested the following solutions for this problem:

Disable WP-Cron: Replace wp-cron.php with a server-side cron job to manage scheduled tasks efficiently.Restrict Access: Protect wp-cron.php by restricting access to trusted IP addresses or using authentication mechanisms.Rate Limiting: Implement rate-limiting rules to prevent abuse of publicly accessible endpoints.Monitoring and Alerts: Regularly monitor server logs for unusual activity and set up alerts for potential abuse.

Realizing the critical nature of this vulnerability, I immediately contacted Bank ‘X’s security team. I provided them with detailed findings, including the steps to reproduce the issue and suggested mitigation measures.

This writeup would highlight the need to focus on securing the most often overlooked components, in this case, wp-cron.php. Organizations need to enforce regular security audits and optimize configurations so that vulnerabilities cannot be exploited.

Note: These types of bugs or vulnerabilities are typically not accepted in most Bug Bounty Programs. Engage in such activities only if you have proper authorization, as performing them without permission may lead to legal consequences.

I would like to thank all my mentors, friends, and fellow mates who always guided me, supported me, and helped me grow. I hope you all enjoyed this and learned something new.

Your Feedback would mean a lot to me and help me even grow better.

LinkedIn: https://www.linkedin.com/in/guru-prasad-pattanaik/
Instagram: https://www.instagram.com/guru.p05/
Twitter: https://x.com/gurupra9161