SiteGuard WP Plugin <= 1.7.6 - Login Page Disclosure

ID: CVE-2024-37881

Severity: medium

Author: s4e-io

Tags: cve,cve-2024,siteguard,wp-plugin

Description

The SiteGuard WP Plugin plugin for WordPress is vulnerable to protection mechanism bypass in all versions up to, and including, 1.7.6. This is due to the plugin not restricting redirects from wp-register.php which may disclose the login page URL. This makes it possible for unauthenticated attackers to gain access to the login page.

YAML Source

id: CVE-2024-37881

info:
  name: SiteGuard WP Plugin <= 1.7.6 - Login Page Disclosure
  author: s4e-io
  severity: medium
  description: |
    The SiteGuard WP Plugin plugin for WordPress is vulnerable to protection mechanism bypass in all versions up to, and including, 1.7.6. This is due to the plugin not restricting redirects from wp-register.php which may disclose the login page URL. This makes it possible for unauthenticated attackers to gain access to the login page.
  reference:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-37881
    - https://jvn.jp/en/jp/JVN60331535/
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/siteguard/siteguard-wp-plugin-176-login-page-disclosure
    - https://www.usom.gov.tr/bildirim/tr-24-0726
  metadata:
    verified: true
    max-request: 1
    publicwww-query: "/wp-content/plugins/siteguard/"
  tags: cve,cve-2024,siteguard,wp-plugin

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/siteguard/readme.txt"

    matchers:
      - type: dsl
        internal: true
        dsl:
          - "status_code == 200"
          - 'contains(body, "SiteGuard WP Plugin")'
        condition: and

  - method: GET
    path:
      - "{{BaseURL}}/wp-register.php"

    matchers:
      - type: dsl
        dsl:
          - "!contains(tolower(location), 'wp-login.php')"

    extractors:
      - type: kval
        kval:
          - location
# digest: 4a0a00473045022100ca7463004372ec3f196a97ad140537b7f4be040910ccf8d2068d6bd23aa570ba022071dcebbc83557a7c059bd85fe336a04f02a7da65aa63fecc99c1cececc567ecb:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2024/CVE-2024-37881.yaml"

View on Github