feat: exercise AJAX and XML-RPC adversarial surfaces

Author: chubes4

examples/recipes/wordpress-adversarial-vulnerable.json

@@ -8,8 +8,9 @@
   "inputs": {
     "mounts": [
       {
-        "source": "../../tests/fixtures/wordpress-adversarial/vulnerable-plugin",
-        "target": "/wordpress/wp-content/plugins/wp-codebox-adversarial-vulnerable",
+        "source": "../../tests/fixtures/wordpress-adversarial/vulnerable-plugin/vulnerable-plugin.php",
+        "target": "/wordpress/wp-content/mu-plugins/wp-codebox-adversarial-vulnerable.php",
+        "type": "file",
         "mode": "readonly",
         "metadata": { "kind": "fixture", "disposableOnly": true }
       },
@@ -25,7 +26,7 @@
     "steps": [
       {
         "command": "wordpress.run-php",
-        "args": ["code=require_once ABSPATH . 'wp-admin/includes/plugin.php'; activate_plugin('wp-codebox-adversarial-vulnerable/vulnerable-plugin.php'); switch_theme('wp-codebox-adversarial-vulnerable'); foreach (array('wp_codebox_vulnerable_authorization', 'wp_codebox_vulnerable_partial_state', 'wp_codebox_vulnerable_injection', 'wp_codebox_vulnerable_race_count', 'wp_codebox_adversarial_http_faults', 'wp_codebox_adversarial_http_fault_counts') as $option) { delete_option($option); }"]
+        "args": ["code=switch_theme('wp-codebox-adversarial-vulnerable'); foreach (array('wp_codebox_vulnerable_authorization', 'wp_codebox_vulnerable_partial_state', 'wp_codebox_vulnerable_ajax', 'wp_codebox_vulnerable_xmlrpc', 'wp_codebox_vulnerable_injection', 'wp_codebox_vulnerable_race_count', 'wp_codebox_adversarial_http_faults', 'wp_codebox_adversarial_http_fault_counts') as $option) { delete_option($option); }"]
       }
     ]
   },
@@ -87,6 +88,62 @@
       "replay": { "selection": "findings" },
       "metadata": { "fixtureDefect": "state-corruption", "network": "deny" }
     },
+    {
+      "schema": "wp-codebox/adversarial-recipe-campaign/v1",
+      "id": "wordpress-vulnerable-ajax",
+      "seed": "wordpress-vulnerable-ajax-v1",
+      "corpus": [
+        { "id": "unauthenticated-ajax", "actions": [{ "type": "ajax-save", "input": { "value": "fixture-value" } }], "signals": ["transport:ajax"] }
+      ],
+      "caseTemplates": [
+        {
+          "id": "ajax-save",
+          "phases": {
+            "action": [{ "command": "wordpress.browser-actions", "args": ["steps-json=[{\"kind\":\"navigate\",\"url\":\"/\",\"waitFor\":\"load\"},{\"kind\":\"evaluate\",\"expression\":\"const response = await fetch('/wp-admin/admin-ajax.php', { method: 'POST', headers: { 'Content-Type': 'application/x-www-form-urlencoded' }, body: 'action=wp_codebox_vulnerable_save&value=fixture-value' }); return response.ok\",\"assert\":true}]", "capture=steps,network", "timeout=30s"] }],
+            "assert": [{ "command": "wordpress.run-php", "args": ["code=if (get_option('wp_codebox_vulnerable_ajax', null) !== null) { throw new RuntimeException('ajax-nonce-bypass'); }"] }],
+            "teardown": [{ "command": "wordpress.run-php", "args": ["code=delete_option('wp_codebox_vulnerable_ajax');"] }]
+          }
+        }
+      ],
+      "mutators": ["scalar"],
+      "oracles": [{ "id": "runtime-status", "severity": "critical", "description": "Unauthenticated AJAX writes without a nonce must fail closed." }],
+      "concurrency": 1,
+      "budgets": { "maxCases": 1, "maxActionsPerCase": 2, "maxInputBytes": 4096, "maxCaseTimeMs": 15000, "maxWallTimeMs": 120000, "maxArtifactBytes": 10485760 },
+      "resetPolicy": { "mode": "none" },
+      "requiredCapabilities": ["adversarial-campaign", "artifact-export", "bounded-evidence", "replay", "command:wordpress.browser-actions", "command:wordpress.run-php"],
+      "novelty": { "retainSignals": true },
+      "shrinking": { "enabled": false },
+      "replay": { "selection": "findings" },
+      "metadata": { "fixtureDefect": "ajax-nonce-bypass", "transportFidelity": "exact", "network": "deny" }
+    },
+    {
+      "schema": "wp-codebox/adversarial-recipe-campaign/v1",
+      "id": "wordpress-vulnerable-xmlrpc",
+      "seed": "wordpress-vulnerable-xmlrpc-v1",
+      "corpus": [
+        { "id": "unauthenticated-xmlrpc", "actions": [{ "type": "xmlrpc-save", "input": {} }], "signals": ["transport:xmlrpc"] }
+      ],
+      "caseTemplates": [
+        {
+          "id": "xmlrpc-save",
+          "phases": {
+            "action": [{ "command": "wordpress.browser-actions", "args": ["steps-json=[{\"kind\":\"navigate\",\"url\":\"/\",\"waitFor\":\"load\"},{\"kind\":\"evaluate\",\"expression\":\"const response = await fetch('/xmlrpc.php', { method: 'POST', headers: { 'Content-Type': 'text/xml' }, body: '<?xml version=\\\"1.0\\\"?><methodCall><methodName>wpCodebox.vulnerable</methodName><params><param><value><string>fixture-value</string></value></param></params></methodCall>' }); return response.ok\",\"assert\":true}]", "capture=steps,network", "timeout=30s"] }],
+            "assert": [{ "command": "wordpress.run-php", "args": ["code=if (get_option('wp_codebox_vulnerable_xmlrpc', null) !== null) { throw new RuntimeException('xmlrpc-authorization-bypass'); }"] }],
+            "teardown": [{ "command": "wordpress.run-php", "args": ["code=delete_option('wp_codebox_vulnerable_xmlrpc');"] }]
+          }
+        }
+      ],
+      "mutators": ["scalar"],
+      "oracles": [{ "id": "runtime-status", "severity": "critical", "description": "Unauthenticated XML-RPC writes must fail closed." }],
+      "concurrency": 1,
+      "budgets": { "maxCases": 1, "maxActionsPerCase": 2, "maxInputBytes": 4096, "maxCaseTimeMs": 15000, "maxWallTimeMs": 120000, "maxArtifactBytes": 10485760 },
+      "resetPolicy": { "mode": "none" },
+      "requiredCapabilities": ["adversarial-campaign", "artifact-export", "bounded-evidence", "replay", "command:wordpress.browser-actions", "command:wordpress.run-php"],
+      "novelty": { "retainSignals": true },
+      "shrinking": { "enabled": false },
+      "replay": { "selection": "findings" },
+      "metadata": { "fixtureDefect": "xmlrpc-authorization-bypass", "transportFidelity": "exact", "network": "deny" }
+    },
     {
       "schema": "wp-codebox/adversarial-recipe-campaign/v1",
       "id": "wordpress-vulnerable-injection",

packages/runtime-playground/src/wordpress-adversarial-adapter.ts

@@ -61,8 +61,8 @@ export interface WordPressAdversarialAdapter {
 
 export const WORDPRESS_ADVERSARIAL_CAPABILITIES: readonly WordPressAdversarialCapability[] = [
   { surface: "rest", fidelity: "exact", reason: "Dispatched through WP_REST_Request and rest_do_request()." },
-  { surface: "ajax", fidelity: "unsupported", reason: "In-process admin-ajax callbacks may terminate PHP; use browser/server requests when an HTTP runtime is available." },
-  { surface: "xmlrpc", fidelity: "unsupported", reason: "The disposable in-process runner does not provide a faithful XML-RPC HTTP request boundary." },
+  { surface: "ajax", fidelity: "exact", reason: "Dispatched through the runtime HTTP server to wp-admin/admin-ajax.php, preserving HTTP and wp_die() termination semantics." },
+  { surface: "xmlrpc", fidelity: "exact", reason: "Dispatched as text/xml through the runtime HTTP server to xmlrpc.php." },
   { surface: "block", fidelity: "exact", reason: "Parsed, serialized, and rendered with WordPress block APIs." },
   { surface: "shortcode", fidelity: "exact", reason: "Executed through do_shortcode()." },
   { surface: "serialized-value", fidelity: "exact", reason: "Round-tripped through maybe_serialize() and maybe_unserialize()." },
@@ -137,6 +137,15 @@ export function wordpressAdversarialActionSpec(action: WordPressAdversarialActio
     if (!command) throw new Error("WordPress adversarial CLI actions require a non-empty string input.")
     return { kind: "command", command: "wordpress.wp-cli", args: [`command=${command}`], operation: `adversarial:${action.surface}`, metadata: actionMetadata(action, capability) }
   }
+  if (action.surface === "ajax") {
+    if (!action.target) throw new Error("WordPress adversarial AJAX actions require the target action name.")
+    const body = new URLSearchParams({ action: action.target, ...httpFormValues(action.input) }).toString()
+    return { kind: "command", command: "wordpress.browser-actions", args: [`steps-json=${JSON.stringify(httpBrowserSteps("/wp-admin/admin-ajax.php", "application/x-www-form-urlencoded", body))}`], operation: "adversarial:ajax", metadata: actionMetadata(action, capability) }
+  }
+  if (action.surface === "xmlrpc") {
+    if (typeof action.input !== "string" || action.input.trim() === "") throw new Error("WordPress adversarial XML-RPC actions require a non-empty XML request body.")
+    return { kind: "command", command: "wordpress.browser-actions", args: [`steps-json=${JSON.stringify(httpBrowserSteps("/xmlrpc.php", "text/xml", action.input))}`], operation: "adversarial:xmlrpc", metadata: actionMetadata(action, capability) }
+  }
   return {
     kind: "command",
     command: "wordpress.run-php",
@@ -309,3 +318,13 @@ function metricBucket(value: number): string {
 function recordValue(value: unknown): Record<string, unknown> | undefined {
   return value && typeof value === "object" && !Array.isArray(value) ? value as Record<string, unknown> : undefined
 }
+
+function httpFormValues(value: unknown): Record<string, string> {
+  const record = recordValue(value)
+  return Object.fromEntries(Object.entries(record ?? {}).map(([name, item]) => [name, typeof item === "string" ? item : JSON.stringify(item)]))
+}
+
+function httpBrowserSteps(path: string, contentType: string, body: string): Array<Record<string, unknown>> {
+  const expression = `const response = await fetch(${JSON.stringify(path)}, { method: 'POST', headers: { 'Content-Type': ${JSON.stringify(contentType)} }, body: ${JSON.stringify(body)} }); return response.ok`
+  return [{ kind: "navigate", url: "/", waitFor: "load" }, { kind: "evaluate", expression, assert: true }]
+}

tests/fixtures/wordpress-adversarial/vulnerable-plugin/vulnerable-plugin.php

@@ -62,10 +62,22 @@
 	));
 });
 
-add_action('wp_ajax_wp_codebox_vulnerable_save', static function (): void {
+$wp_codebox_vulnerable_ajax = static function (): void {
 	// Intentionally vulnerable: no check_ajax_referer() or capability check.
 	update_option('wp_codebox_vulnerable_ajax', wp_unslash($_POST['value'] ?? ''), false);
 	wp_send_json_success(array('violations' => array('ajax-nonce-bypass')));
+};
+add_action('wp_ajax_wp_codebox_vulnerable_save', $wp_codebox_vulnerable_ajax);
+add_action('wp_ajax_nopriv_wp_codebox_vulnerable_save', $wp_codebox_vulnerable_ajax);
+
+function wp_codebox_adversarial_vulnerable_xmlrpc($args): array {
+	update_option('wp_codebox_vulnerable_xmlrpc', $args, false);
+	return array('saved' => true, 'violations' => array('xmlrpc-authorization-bypass'));
+}
+
+add_filter('xmlrpc_methods', static function (array $methods): array {
+	$methods['wpCodebox.vulnerable'] = 'wp_codebox_adversarial_vulnerable_xmlrpc';
+	return $methods;
 });
 
 add_shortcode('wp_codebox_vulnerable', static function (array $attributes): string {

tests/wordpress-adversarial-adapter.test.ts

@@ -17,15 +17,21 @@ import {
 const adapter = createWordPressAdversarialAdapter()
 assert.equal(adapter.schema, "wp-codebox/wordpress-adversarial-adapter/v1")
 assert.equal(WORDPRESS_ADVERSARIAL_CAPABILITIES.find(({ surface }) => surface === "rest")?.fidelity, "exact")
-assert.equal(WORDPRESS_ADVERSARIAL_CAPABILITIES.find(({ surface }) => surface === "ajax")?.fidelity, "unsupported")
+assert.equal(WORDPRESS_ADVERSARIAL_CAPABILITIES.find(({ surface }) => surface === "ajax")?.fidelity, "exact")
+assert.equal(WORDPRESS_ADVERSARIAL_CAPABILITIES.find(({ surface }) => surface === "xmlrpc")?.fidelity, "exact")
 assert.equal(WORDPRESS_CLOCK_CONTROL_CAPABILITIES.capabilities.find(({ surface }) => surface === "runtime")?.fidelity, "unsupported")
 assert.equal(WORDPRESS_CLOCK_CONTROL_CAPABILITIES.capabilities.find(({ surface }) => surface === "scheduler")?.fidelity, "emulated")
 
 const rest = wordpressAdversarialActionSpec({ surface: "rest", operation: "POST", target: "/fixture/v1/action", input: { value: "mutated" } })
 assert.equal(rest.command, "wordpress.run-php")
 assert.equal(rest.metadata?.fidelity, "exact")
 assert.match(rest.args?.[0] ?? "", /WP_REST_Request/)
-assert.throws(() => wordpressAdversarialActionSpec({ surface: "xmlrpc", operation: "POST" }), /unsupported/)
+const ajax = wordpressAdversarialActionSpec({ surface: "ajax", operation: "POST", target: "fixture_save", input: { value: "mutated" } })
+assert.equal(ajax.command, "wordpress.browser-actions")
+assert.match(ajax.args?.find((arg) => arg.startsWith("steps-json=")) ?? "", /action=fixture_save&value=mutated/)
+const xmlrpc = wordpressAdversarialActionSpec({ surface: "xmlrpc", operation: "POST", input: "<methodCall><methodName>fixture.echo</methodName></methodCall>" })
+assert.equal(xmlrpc.command, "wordpress.browser-actions")
+assert.match(xmlrpc.args?.[0] ?? "", /xmlrpc\.php/)
 
 const cli = wordpressAdversarialActionSpec({ surface: "cli", operation: "run", input: "option get home" })
 assert.deepEqual(cli.args, ["command=option get home"])