InfiniteWP Client NOSSL signing key recovered in 291.9 seconds
Original title: InfiniteWP Client: the NOSSL signing key has 31 bits of secret — recovered live in 291.9 seconds
The NOSSL signing key in InfiniteWP Client 1.13.10 with 31 bits of entropy is recovered live in 291.9 seconds after permanent selection via a request parameter.
InfiniteWP Client 1.13.10 on roughly 200,000 installs uses two authentication branches to manage panel access. The NOSSL branch is selected permanently once a request parameter is set and stores a generated signing key. The key's 31 bits of secret entropy allow recovery in 291.9 seconds, after which the RSA branch becomes unreachable.
- NOSSL branch selected via one request parameter
- Key stored permanently after selection
- RSA branch becomes unreachable
- Roughly 200,000 installs affected
Impact: weak signing key allowing key recovery
- Vendors
- InfiniteWP
- Products
- InfiniteWP Client
From the original article
Posted by theknell on Nov 06 InfiniteWP Client 1. 13. 10 — a WordPress management plugin on roughly 200,000 installs — speaks to its management panel through two authentication branches.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.