We’re happy to announce that our partner, PatchStack, has completely addressed, reaudited, and passed our security audit with flying colours. CardanoPress now has a solid security foundation for anyone who uses it to build Cardano-powered websites with WordPress.
It is beneficial for all websites using CardanoPress to upgrade to version 1.22.0, now available in the WordPress plugin directory. This complete version addresses all issues, suggestions, and critical vulnerabilities in the plugin.
Summary of Changes
Added in 1.20.0
- Add index.php files to all folders
- Protect log files from public access
- Escape missed attributes in shortcodes
- Sanitize provided shortcode template name
Added in 1.21.0
- Data/message signing for wallet authentication
- Minor adjustments to the framework and dependencies
Added in 1.22.0
- Fix data/message for certain wallets
- Use the prefixed PSR/Log dependency
View the full list of releases and change logs on the CardanoPress Github repository.
Addressing the CardanoPress Audit
Informative
- Absence of index.php files – Commit 4306725
Low
- Missing Nonce Token Validation – Commit 78a3c67
Medium
- Sensitive Data Exposure via Log File – Commit 0e0c3d2
- Admin+ Stored Cross Site Scripting (XSS) – Commit fb4e28d
- Missing Nonce Token Validation and Authorization – Commit 78a3c67
- Contributor+ Stored Cross Site Scripting (XSS) – Commit b8f0146
- Admin+ Local File Inclusion – Commit 5fd6328
High
- Contributor+ Local File Inclusion – Commit fb4e28d
Critical
- Unauthenticated Account Takeover – Release 1.21.0
Addressing the Framework Audit
Informative
- Absence of index.php files – Commit 4306725
Low
- Missing Nonce Token Validation – Commit 78a3c67
Medium
- Sensitive Data Exposure via Log File – Commit 0e0c3d2
Addition of Message Signing
The most notable change to CardanoPress, which addressed a potentially critical issue, was adding Data/message signing for wallet authentication. This implements the Cardano Improvement Proposal (CIP) 8 – Message Signing.
Previously, users could connect and authenticate to a website in one step using their wallet. This posed a risk; anyone accessing that wallet could impersonate the user. Additionally, users could access the website using a hash of their stake key. By now requiring users to sign in with their private key, it becomes impossible for someone to mimic another user or access the wallet without knowing the user’s signing password. This increases the level of security immensely for the login and authentication process.
Other issues that were addressed improved the plugin’s coding standards, closing potential openings that hackers could use to obtain information about the website, server, and plugin via error logs and files displayed in the plugin folders.
We’ve uploaded a copy of PatchStack’s full security audit of CardanoPress and the updated reaudit of CardanoPress, which confirms how we have addressed each issue.
Project Catalyst Fund 11 Close Out
This concludes the final milestone for the CardanoPress Security audit for Fund 11. We want to thank everyone who voted for our proposal, as well as all the reviewers, advisors, and the Project Catalyst team themselves, for facilitating the Project’s operations.
Please follow us on X and join our Discord server to stay updated on the latest developments around CardanoPress.