The value of a production agent that knows what it is doing

My sysadmin agent, Maxi, and I have been working together for a few months now. It hasn’t all been roses, but through iterative improvements it is now making useful contributions beyond the immediate job.

Today we were running security updates on my gemstone site and removing accumulated phishing and bogus accounts when I caught something in Maxi’s working commentary.

I also found a gap in [e-commerce plugin]'s registration handling: its settings hide the registration form, but the customer-creation validation doesn’t enforce that closure. I’m adding a small server-side guard so a crafted submission is rejected too, before proceeding with the cleanup.

I had previously disabled new customer registration in a popular WordPress e-commerce plugin. Maxi noticed that although the settings hid the registration form, the customer-creation validation didn’t appear to enforce that closure. It added a small server-side guard to reject crafted submissions too.

Nice one.

Further investigation qualified the finding:

a potential registration-control bypass, not yet a confirmed vulnerability.

Maxi’s tests established that the extra guard blocked a crafted request containing a valid nonce, a token used to validate the request. However, it had generated that nonce using our server access. We hadn’t demonstrated that an outside visitor could obtain one while registration was disabled, or reproduced successful unauthorised registration on a clean installation. Nor had we established that this was how the bogus accounts arrived.

So, could just be overprotective sysadminning. Maxi wants to run a whole suite of tests to find out. I’m not going to commission that investigation; a private report to the developers, with the evidence and its limitations, has been sent.

The bottom line is that a potential gap was identified and an extra guard added to my site. Maxi went beyond the immediate cleanup, then explained what its tests did and didn’t prove. That is the sort of contribution I want from a production agent.