vigilante / includes / security-analyzer / class-sa-category-access.php

class-sa-category-access.php in Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner… 3.0.5, at includes/security-analyzer/class-sa-category-access.php

392 lines 16.5 KB

Raw Download Zip

1	<?php
2	/**
3	* Security Analyzer — Access/Auth category (20 pts).
4	*
5	* Checks: wp_login_path (5), xmlrpc (5), wp_admin_direct (2),
6	* rest_users_me (2), login_rate_limit (3), two_factor_enabled (3).
7	*
8	* @package Vigilante
9	* @since 2.1.0
10	*/
11
12	// Prevent direct access.
13	if ( ! defined( 'ABSPATH' ) ) {
14	exit;
15	}
16
17	/**
18	* Authentication and access-control checks.
19	*/
20	class Vigilante_SA_Category_Access {
21
22	const SLUG = 'access';
23
24	/**
25	* @var Vigilante_Settings
26	*/
27	private $settings;
28
29	public function __construct( Vigilante_Settings $settings ) {
30	$this->settings = $settings;
31	}
32
33	/**
34	* Run the category.
35	*
36	* @param string $phase 'fast' \| 'slow' \| 'all'.
37	* @return Vigilante_SA_Check_Result[]
38	*/
39	public function run( $phase = 'all' ) {
40	$results = array();
41
42	if ( 'fast' === $phase \|\| 'all' === $phase ) {
43	$results[] = $this->check_custom_login_url();
44	$results[] = $this->check_xmlrpc_setting();
45	$results[] = $this->check_login_rate_limit();
46	$results[] = $this->check_two_factor_enabled();
47	}
48
49	if ( 'slow' === $phase \|\| 'all' === $phase ) {
50	$results[] = $this->check_wp_admin_direct();
51	$results[] = $this->check_rest_users_me();
52	}
53
54	return $results;
55	}
56
57	private function check_custom_login_url() {
58	$args = array(
59	'id' => 'wp_login_path',
60	'category' => self::SLUG,
61	'max' => 5,
62	'label' => __( 'Custom login URL', 'vigilante' ),
63	'fix_link' => Vigilante_SA_Helpers::build_fix_url( 'login', 'field-custom-login-url' ),
64	);
65
66	$url = trim( (string) $this->settings->get_option( 'login_security', 'custom_login_url', '' ) );
67	if ( '' === $url ) {
68	$args['detail'] = __( 'The login page is still the default /wp-login.php — a known bot target.', 'vigilante' );
69	return Vigilante_SA_Check_Result::fail( $args );
70	}
71
72	// The slug is served by the Login Security class, which only loads
73	// with its module on.
74	if ( ! $this->settings->is_module_enabled( 'login_security' ) ) {
75	$args['detail'] = Vigilante_SA_Helpers::module_off_detail( $this->settings, 'login_security' );
76	return Vigilante_SA_Check_Result::fail( $args );
77	}
78
79	$args['detail'] = sprintf(
80	/* translators: %s: slug */
81	__( 'Custom login URL set to /%s. Remember to bookmark it.', 'vigilante' ),
82	$url
83	);
84	return Vigilante_SA_Check_Result::pass( $args );
85	}
86
87	private function check_xmlrpc_setting() {
88	$args = array(
89	'id' => 'xmlrpc',
90	'category' => self::SLUG,
91	'max' => 5,
92	'label' => __( 'XML-RPC status', 'vigilante' ),
93	'fix_link' => Vigilante_SA_Helpers::build_fix_url( 'wp-hardening', 'vigilante-section-hardening-xmlrpc' ),
94	);
95
96	// Read the setting through the module's own resolver rather than the raw
97	// option: XML-RPC is now a three-way choice, and sites upgrading from the
98	// old pair of checkboxes still store only those. Reading disable_xmlrpc
99	// directly made this check fail on sites whose XML-RPC was in fact fully
100	// blocked, which is the contradiction the /wp/v2/users/me check had.
101	$mode = 'none';
102	if ( class_exists( 'Vigilante_Comment_Security' ) ) {
103	$mode = Vigilante_Comment_Security::resolve_xmlrpc_mode( $this->settings );
104	} elseif ( $this->settings->get_option( 'login_security', 'disable_xmlrpc', 0 ) ) {
105	$mode = 'full';
106	}
107
108	// The mode is applied by Vigilante_Comment_Security, which only loads
109	// with the WordPress Hardening module on (vigilante.php). With the
110	// module off the saved mode does nothing, and until 3.0.4 this check
111	// passed on it while the Dashboard recommended blocking XML-RPC.
112	$saved_mode = $mode;
113	if ( ! $this->settings->is_module_enabled( 'wp_hardening' ) ) {
114	$mode = 'none';
115	}
116
117	$args['data'] = array(
118	'mode' => $mode,
119	'saved_mode' => $saved_mode,
120	);
121
122	if ( 'none' === $mode && 'none' !== $saved_mode ) {
123	$args['detail'] = Vigilante_SA_Helpers::module_off_detail( $this->settings, 'wp_hardening' );
124	return Vigilante_SA_Check_Result::fail( $args );
125	}
126
127	if ( 'full' === $mode ) {
128	$args['detail'] = __( 'XML-RPC is fully disabled; brute-force and pingback amplification vectors closed.', 'vigilante' );
129	return Vigilante_SA_Check_Result::pass( $args );
130	}
131
132	if ( 'pingback' === $mode ) {
133	$args['detail'] = __( 'Pingback methods are blocked, which closes the amplification vector, and the rest of XML-RPC stays available for the mobile app or Jetpack.', 'vigilante' );
134	return Vigilante_SA_Check_Result::pass( $args );
135	}
136
137	$args['detail'] = __( 'XML-RPC is fully enabled. Under WP Hardening, disable it completely, or block at least the pingback methods if something still needs XML-RPC.', 'vigilante' );
138	return Vigilante_SA_Check_Result::fail( $args );
139	}
140
141	private function check_login_rate_limit() {
142	$args = array(
143	'id' => 'login_rate_limit',
144	'category' => self::SLUG,
145	'max' => 3,
146	'label' => __( 'Brute-force lockout threshold', 'vigilante' ),
147	'fix_link' => Vigilante_SA_Helpers::build_fix_url( 'login', 'field-max-attempts' ),
148	);
149
150	$max = (int) $this->settings->get_option( 'login_security', 'max_attempts', 0 );
151	$args['data'] = array( 'max_attempts' => $max );
152
153	if ( 0 === $max ) {
154	$args['detail'] = __( 'Login lockout is not configured. Any IP can try passwords without limit.', 'vigilante' );
155	return Vigilante_SA_Check_Result::fail( $args );
156	}
157	// Attempts are counted by the Login Security class, which only loads
158	// with its module on.
159	if ( ! $this->settings->is_module_enabled( 'login_security' ) ) {
160	$args['detail'] = Vigilante_SA_Helpers::module_off_detail( $this->settings, 'login_security' );
161	return Vigilante_SA_Check_Result::fail( $args );
162	}
163	if ( $max > 10 ) {
164	$args['detail'] = sprintf(
165	/* translators: %d: configured attempts */
166	__( 'Lockout after %d attempts is too permissive. Lower it to 5 or fewer.', 'vigilante' ),
167	$max
168	);
169	return Vigilante_SA_Check_Result::warn( $args );
170	}
171	if ( $max > 5 ) {
172	$args['detail'] = sprintf(
173	/* translators: %d: configured attempts */
174	__( 'Lockout after %d attempts is acceptable but tighter is better.', 'vigilante' ),
175	$max
176	);
177	return Vigilante_SA_Check_Result::warn( $args );
178	}
179
180	$args['detail'] = sprintf(
181	/* translators: %d: configured attempts */
182	__( 'Lockout after %d failed attempts.', 'vigilante' ),
183	$max
184	);
185	return Vigilante_SA_Check_Result::pass( $args );
186	}
187
188	private function check_two_factor_enabled() {
189	$args = array(
190	'id' => 'two_factor_enabled',
191	'category' => self::SLUG,
192	'max' => 3,
193	'label' => __( 'Two-factor authentication status', 'vigilante' ),
194	'fix_link' => Vigilante_SA_Helpers::build_fix_url( 'login', 'vigilante-section-login-2fa' ),
195	);
196
197	$two_factor = $this->settings->get_option( 'login_security', 'two_factor', array() );
198	$saved_here = ! empty( $two_factor['enabled'] );
199
200	// A site asks for a second factor when two factor is enabled AND its
201	// Login Security module is on: that is the rule the login itself
202	// follows, on a single site because the two classes only load with the
203	// module, and on a network because
204	// Vigilante_Settings::two_factor_demands_for() leaves out every site
205	// whose module is off.
206	$asks = $saved_here && $this->settings->is_module_enabled( 'login_security' );
207
208	// On a network the main site asks for everybody, so its policy counts
209	// here too, read with the same two conditions and from what it has
210	// stored, as the login does.
211	if ( ! $asks && is_multisite() ) {
212	$main = get_blog_option( get_main_site_id(), Vigilante_Settings::OPTION_NAME, array() );
213
214	if ( is_array( $main )
215	&& ! empty( $main['modules']['login_security'] )
216	&& ! empty( $main['login_security']['two_factor']['enabled'] ) ) {
217	$two_factor = $main['login_security']['two_factor'];
218	$asks = true;
219	}
220	}
221
222	if ( ! $asks && $saved_here ) {
223	$args['detail'] = Vigilante_SA_Helpers::module_off_detail( $this->settings, 'login_security' );
224	return Vigilante_SA_Check_Result::fail( $args );
225	}
226
227	if ( $asks ) {
228	$method = ( isset( $two_factor['method'] ) && is_string( $two_factor['method'] ) ) ? $two_factor['method'] : 'email';
229	$args['detail'] = sprintf(
230	/* translators: %s: 2FA method */
231	__( '2FA enabled globally using %s.', 'vigilante' ),
232	strtoupper( $method )
233	);
234	return Vigilante_SA_Check_Result::pass( $args );
235	}
236
237	$args['detail'] = __( 'Two-factor authentication is disabled. Enable it at least for administrators.', 'vigilante' );
238	return Vigilante_SA_Check_Result::fail( $args );
239	}
240
241	private function check_wp_admin_direct() {
242	$args = array(
243	'id' => 'wp_admin_direct',
244	'category' => self::SLUG,
245	'max' => 2,
246	'label' => __( '/wp-admin/ public access', 'vigilante' ),
247	'fix_link' => '',
248	);
249
250	$url = trailingslashit( admin_url() );
251	$response = Vigilante_SA_Helpers::get( $url, array( 'redirection' => 0 ) );
252
253	if ( is_wp_error( $response ) ) {
254	$args['detail'] = __( 'Could not probe /wp-admin/.', 'vigilante' );
255	return Vigilante_SA_Check_Result::skip( $args );
256	}
257
258	$code = (int) wp_remote_retrieve_response_code( $response );
259	$location = (string) wp_remote_retrieve_header( $response, 'location' );
260
261	// Anonymous access to /wp-admin/ is considered safe when it either
262	// redirects to a login page (typical) or is blocked/hidden (4xx).
263	// A 200 with an HTML body is the only truly bad outcome.
264	if ( in_array( $code, array( 301, 302, 303, 307, 308 ), true ) && $location ) {
265	// Until 3.0.4 every redirect was said to lead to the login page.
266	// With the login hidden it leads somewhere else, and so does a
267	// redirect to another host or scheme: the text says the login
268	// page only when that is where it goes.
269	$args['detail'] = $this->leads_to_login( $location )
270	? __( '/wp-admin/ redirected anonymous visits to the login page.', 'vigilante' )
271	: __( '/wp-admin/ redirected anonymous visits to another address.', 'vigilante' );
272	$args['data'] = array( 'code' => $code, 'location' => $location );
273	return Vigilante_SA_Check_Result::pass( $args );
274	}
275
276	// 4xx => camouflaged URL, firewall rule, or permission denied. All good.
277	if ( $code >= 400 && $code < 500 ) {
278	$args['detail'] = sprintf(
279	/* translators: %d: HTTP status code */
280	__( '/wp-admin/ returned %d to anonymous visitors.', 'vigilante' ),
281	$code
282	);
283	$args['data'] = array( 'code' => $code );
284	return Vigilante_SA_Check_Result::pass( $args );
285	}
286
287	if ( 200 === $code ) {
288	$args['detail'] = __( '/wp-admin/ returned 200 OK to an anonymous request. Verify nothing sensitive is exposed.', 'vigilante' );
289	$args['data'] = array( 'code' => $code );
290	return Vigilante_SA_Check_Result::fail( $args );
291	}
292
293	// 5xx or other weirdness — server issue, not a hardening problem on our side.
294	$args['detail'] = sprintf(
295	/* translators: %d: HTTP status code */
296	__( '/wp-admin/ responded with %d. This usually indicates a server error rather than a security issue.', 'vigilante' ),
297	$code
298	);
299	$args['data'] = array( 'code' => $code );
300	return Vigilante_SA_Check_Result::warn( $args );
301	}
302
303	/**
304	* Whether a redirect goes to the login form of this site
305	*
306	* @since 3.0.5
307	*
308	* @param string $location Value of the Location header, absolute or relative.
309	* @return bool
310	*/
311	private function leads_to_login( $location ) {
312	$to = rawurldecode( (string) wp_parse_url( (string) $location, PHP_URL_PATH ) );
313	if ( '' === $to ) {
314	return false;
315	}
316	if ( 'wp-login.php' === basename( $to ) ) {
317	return true;
318	}
319
320	// A login address that is not wp-login.php, as this site declares it.
321	$login = rawurldecode( (string) wp_parse_url( wp_login_url(), PHP_URL_PATH ) );
322
323	return '' !== $login && untrailingslashit( $login ) === untrailingslashit( $to );
324	}
325
326	/**
327	* The address that tells a visitor who they are
328	*
329	* Not the list of users, which is check_rest_users_enum() in the
330	* WordPress exposure category: the two were named almost the same and
331	* were taken for one. WordPress answers 401 here to anybody with no
332	* session, with Vigilant or without it, so the usual result says so and
333	* scores nothing: until 3.0.4 it gave 2 points to every site, whatever
334	* was set. It only scores, as a failure, when the address answers a
335	* visitor with no session with something else.
336	*/
337	private function check_rest_users_me() {
338	$args = array(
339	'id' => 'rest_users_me',
340	'category' => self::SLUG,
341	'max' => 2,
342	'label' => __( 'REST: current user (/wp/v2/users/me)', 'vigilante' ),
343	'fix_link' => Vigilante_SA_Helpers::build_fix_url( 'rest-api', 'vigilante-section-rest-api-main' ),
344	);
345
346	$url = rest_url( 'wp/v2/users/me' );
347	$response = Vigilante_SA_Helpers::get( $url, array( 'redirection' => 0 ) );
348
349	if ( is_wp_error( $response ) ) {
350	$args['detail'] = __( 'Could not probe /wp/v2/users/me.', 'vigilante' );
351	return Vigilante_SA_Check_Result::skip( $args );
352	}
353
354	$code = (int) wp_remote_retrieve_response_code( $response );
355	$body = (string) wp_remote_retrieve_body( $response );
356
357	// Answering as it should is informative: no points, and no link to a
358	// setting, because none makes this happen.
359	$fine = function ( $detail ) use ( $args ) {
360	$args['detail'] = $detail;
361	unset( $args['fix_link'] );
362	return Vigilante_SA_Check_Result::info( $args );
363	};
364
365	if ( 401 === $code ) {
366	return $fine( __( 'It answers 401 to a visitor with no session, as WordPress does by itself on any site. Whether the list of users can be seen is a different check.', 'vigilante' ) );
367	}
368	if ( 403 === $code ) {
369	return $fine( __( 'The endpoint returns 403 to unauthenticated requests.', 'vigilante' ) );
370	}
371
372	// 404 with rest_no_route => Vigilant's own rest_endpoints filter removed
373	// the route, which is what "Block user enumeration" does by default. An
374	// unregistered route cannot answer 401, so demanding one made the check
375	// fail on a stock install and pushed users to disable a real protection
376	// to recover the points. Same treatment as the sibling /wp/v2/users check.
377	if ( 404 === $code ) {
378	if ( false !== strpos( $body, 'rest_no_route' ) ) {
379	return $fine( __( 'The /wp/v2/users/me route is unregistered for anonymous clients.', 'vigilante' ) );
380	}
381	return $fine( __( 'The /wp/v2/users/me route returned 404 to the anonymous probe (likely a firewall rule).', 'vigilante' ) );
382	}
383
384	$args['detail'] = sprintf(
385	/* translators: %d: HTTP status code */
386	__( '/wp/v2/users/me responded with %d — should be 401 for anonymous.', 'vigilante' ),
387	$code
388	);
389	return Vigilante_SA_Check_Result::fail( $args );
390	}
391	}
392