OpenSRS/Resellone API Security

[milosvbl]

After short thinking of administration approach used in WHMCS for OpenSrs and ResellOne registrars, I have found that it could be relatively easy to compromise the domains of WHMCS users and gain administrative control over them.

 

Having in mind that WHMCS registers domains through these registrars and create username/password combination based on domain name and domain id in WHMCS panel, it would be possible for external parties to guess the domain id used in control panel and successfully login to administrative interface of respective registrar.

 

My proposal for solution of this problem is simple: WHMCS should add additional field in the administration area where admins could define additional keyword, which should be used for creating hash based on domain id. Eg, if this hash/password is currently created only using md5 on domain id in the panel, in this proposal it could be used on a such what that predefined keyword is concatenated to the domain id and such way the new unique and harder-to-guess password could be combined.

 

It is strange for me that such naive approach has been selected and that no known security breaches have been made.

[efisher]

After short thinking of administration approach used in WHMCS for OpenSrs and ResellOne registrars, I have found that it could be relatively easy to compromise the domains of WHMCS users and gain administrative control over them.

 

Having in mind that WHMCS registers domains through these registrars and create username/password combination based on domain name and domain id in WHMCS panel, it would be possible for external parties to guess the domain id used in control panel and successfully login to administrative interface of respective registrar.

 

My proposal for solution of this problem is simple: WHMCS should add additional field in the administration area where admins could define additional keyword, which should be used for creating hash based on domain id. Eg, if this hash/password is currently created only using md5 on domain id in the panel, in this proposal it could be used on a such what that predefined keyword is concatenated to the domain id and such way the new unique and harder-to-guess password could be combined.

 

It is strange for me that such naive approach has been selected and that no known security breaches have been made.

 

+1 for me. I agree, the way that WHMCS authenticates with OpenSRS is a little odd. I would hope for some site-specific key or prefix that could make our instance unique and harder to guess those passwords.