CVE-2024-10924: fallo crítico en Really Simple Security Pro
Really Simple Security (Free, Pro, and Pro Multisite) 9.0.0 - 9.1.1.1 - Authentication Bypass
Publicada el · Actualizada el
100Vexday Risk Score
Corrige ahora. Ella explotación observada por VulnCheck y tiene exploit funcional público.
ssvc Actcvss 9.8epss 82%
de la publicación al arma0 días
Publicada en NVD15 nov
1ª PoC14 nov
metasploit14 nov
VulnCheck14 nov
probabilidad de explotación
82%top 1% de las CVE
explotación observada
síVulnCheck
39 exploit(s) público(s)
The Really Simple Security (Free, Pro, and Pro Multisite) plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. This is due to improper user check error handling in the two-factor REST API actions with the 'check_login_and_get_user' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, when the "Two-Factor Authentication" setting is enabled (disabled by default).
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
Really Simple Plugins · Really Simple Security ProReally Simple Plugins · Really Simple Security Pro multisiterogierlankhorst · Really Simple Security – Simple and Performant Security (formerly Really Simple SSL)PoCs públicas encontradas — 39
exploitdbwww.exploit-db.com/exploits/52207no verificadogithubgithub.com/m3ssap0/wordpress-really-simple-security-authn-bypass-exploit★ 20githubgithub.com/JoshuaProvoste/0-click-RCE-Exploit-for-CVE-2024-10924★ 14githubgithub.com/m3ssap0/wordpress-really-simple-security-authn-bypass-vulnerable-application★ 8githubgithub.com/Maalfer/CVE-2024-10924-PoC★ 7githubgithub.com/RandomRobbieBF/CVE-2024-10924★ 4githubgithub.com/D1se0/CVE-2024-10924-Bypass-MFA-Wordpress-LAB★ 4githubgithub.com/ademto/wordpress-cve-2024-10924-pentest★ 3githubgithub.com/Trackflaw/CVE-2024-10924-Wordpress-Docker★ 3githubgithub.com/h8sU/wordpress-cve-2024-10924-exploit★ 2githubgithub.com/Nxploited/CVE-2024-10924-Exploit★ 2githubgithub.com/MaleeshaUdan/wordpress-CVE-2024-10924--exploit★ 1githubgithub.com/sharafu-sblsec/CVE-2024-10924★ 0githubgithub.com/sariamubeen/CVE-2024-10924★ 0githubgithub.com/bodoinon/CVE-2024-10924★ 0githubgithub.com/Hunt3r850/CVE-2024-10924-Wordpress-Docker★ 0githubgithub.com/d0x-awrqxavc/-CVE-2024-10924★ 0githubgithub.com/julesbsz/CVE-2024-10924★ 0githubgithub.com/Hunt3r850/CVE-2024-10924-PoC★ 0githubgithub.com/cy3erdr4g0n/CVE-2024-10924★ 0githubgithub.com/MattJButler/CVE-2024-10924★ 0vulncheckvulncheck.com/xdb/0663a7f06bf8no verificadovulncheckvulncheck.com/xdb/a74366f1cd84no verificadovulncheckvulncheck.com/xdb/1997d266f939no verificadovulncheckvulncheck.com/xdb/8634c35fdcb0no verificadovulncheckvulncheck.com/xdb/76c914e1bdd9no verificadovulncheckvulncheck.com/xdb/13284a68c78ano verificadovulncheckvulncheck.com/xdb/85d4b8964e2ano verificadovulncheckvulncheck.com/xdb/7a0dbe5aa614no verificadovulncheckvulncheck.com/xdb/ae64ddac2bbano verificadovulncheckvulncheck.com/xdb/7dd188d235deno verificadovulncheckvulncheck.com/xdb/09e17f47becfno verificadovulncheckvulncheck.com/xdb/425971f1cc80no verificadovulncheckvulncheck.com/xdb/8e53b1ad6a94no verificadovulncheckvulncheck.com/xdb/1c53cd3c68d3no verificadovulncheckvulncheck.com/xdb/1d9c43a3144bno verificadovulncheckvulncheck.com/xdb/e6fb94b04b8eno verificadovulncheckvulncheck.com/xdb/8bcaff452a99no verificadovulncheckvulncheck.com/xdb/420953eef7a7no verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
Referencias
https://github.com/JoshuaProvoste/0-click-RCE-Exploit-for-CVE-2024-10924https://plugins.trac.wordpress.org/browser/really-simple-ssl/tags/9.1.1.1/security/wordpress/two-fa/class-rsssl-two-factor-on-board-api.php#L277https://plugins.trac.wordpress.org/browser/really-simple-ssl/tags/9.1.1.1/security/wordpress/two-fa/class-rsssl-two-factor-on-board-api.php#L278https://plugins.trac.wordpress.org/browser/really-simple-ssl/tags/9.1.1.1/security/wordpress/two-fa/class-rsssl-two-factor-on-board-api.php#L67https://plugins.trac.wordpress.org/changeset/3188431/really-simple-sslhttps://www.wordfence.com/blog/2024/11/really-simple-security-vulnerability/https://www.wordfence.com/threat-intel/vulnerabilities/id/7d5d05ad-1a7a-43d2-bbbf-597e975446be?source=cve