TrendingExploit
CVE-2024-10924

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

Published: Nov 15, 2024 / Updated: 5d ago

010
CVSS 9.8EPSS 0.05%Critical
CVE info copied to clipboard

Summary

The Really Simple Security (Free, Pro, and Pro Multisite) plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. This vulnerability is caused by improper user check error handling in the two-factor REST API actions with the 'check_login_and_get_user' function. It affects installations where the "Two-Factor Authentication" setting is enabled, which is disabled by default.

Impact

This vulnerability allows unauthenticated attackers to log in as any existing user on the site, including administrators. The potential impact is severe, as it could lead to complete compromise of the WordPress site. An attacker could gain full administrative access, potentially allowing them to modify content, install malicious plugins, access sensitive information, or use the compromised site for further attacks. The vulnerability has a CVSS v3.1 base score of 9.8 (Critical), indicating maximum impact on confidentiality, integrity, and availability.

Exploitation

One proof-of-concept exploit is available on github.com. There is no evidence of proof of exploitation at the moment.

Patch

A patch is available. Users should update to a version newer than 9.1.1.1 of the Really Simple Security plugin (Free, Pro, or Pro Multisite versions).

Mitigation

1. Update the Really Simple Security plugin to the latest version immediately if you're running versions 9.0.0 to 9.1.1.1. 2. If immediate updating is not possible, consider temporarily disabling the "Two-Factor Authentication" feature in the plugin settings until the update can be applied. 3. Monitor WordPress admin accounts for any suspicious activities. 4. Implement additional security measures such as IP restrictions for admin access and regular security audits. 5. Always keep WordPress core, themes, and plugins up to date. 6. Use strong, unique passwords for all user accounts, especially administrative ones.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Timeline

CVE Assignment

NVD published the first details for CVE-2024-10924

Nov 15, 2024 at 4:15 AM
CVSS

A CVSS base score of 9.8 has been assigned.

Nov 15, 2024 at 4:20 AM / nvd
First Article

Feedly found the first article mentioning CVE-2024-10924. See article

Nov 15, 2024 at 4:21 AM / National Vulnerability Database
CVSS Estimate

Feedly estimated the CVSS score as HIGH

Nov 15, 2024 at 4:21 AM
Threat Intelligence Report

CVE-2024-10924 is a critical authentication bypass vulnerability affecting versions 9.0.0 to 9.1.1.1 of the Really Simple Security plugins, with a CVSS score of 9.8. The vulnerability has been researched by István Márton from Wordfence, and a fully patched version (9.1.2) is available. There is no information provided regarding exploitation in the wild, proof-of-concept exploits, or downstream impacts on other third-party vendors. See article

Nov 15, 2024 at 8:00 AM
EPSS

EPSS Score was set to: 0.05% (Percentile: 16.9%)

Nov 15, 2024 at 10:20 AM
Proof of Concept (PoC) Released

A proof of concept exploit has been released

Nov 18, 2024 at 2:10 AM
Detection in Vulnerability Scanners

Detection for the vulnerability has been added to Qualys (731906)

Nov 18, 2024 at 7:53 AM
Detection in Vulnerability Scanners

Detection for the vulnerability has been added to Qualys (152399)

Nov 18, 2024 at 7:53 AM
Static CVE Timeline Graph

Affected Systems

Wordpress/wordpress
+null more

Exploits

https://github.com/FoKiiin/CVE-2024-10924
+null more

Links to Mitre Att&cks

T1083: File and Directory Discovery
+null more

Attack Patterns

CAPEC-127: Directory Indexing
+null more

References

WordPress-ReallySimpleSecurity插件认证绕过漏洞(CVE-2024-10924)
On November 6th, 2024, our Wordfence Threat Intelligence team identified and began the responsible disclosure process for an Authentication Bypass vulnerability in the [Really Simple Security plugin](https://wordpress.org/plugins/really-simple-ssl/), and in the [Really Simple Security Pro and Pro Multisite plugins](https://really-simple-ssl.com/pro/), which are actively installed on more than 4,000,000 WordPress websites. 4,000,000 WordPress Sites Using Really Simple Security Free and Pro Versions Affected by Critical Authentication Bypass Vulnerability
4,000,000 WordPress Sites Using Really Simple Security Free and Pro Versions Affected by Critical Authentication Bypass Vulnerability
On November 6th, 2024, our Wordfence Threat Intelligence team identified and began the responsible disclosure process for an Authentication Bypass vulnerability in the Really Simple Security plugin, and in the Really Simple Security Pro and Pro Multisite plugins, which are actively installed on more than 4,000,000 WordPress websites. The Really Simple Security (Free, Pro, and Pro Multisite) plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1.
4,000,000 WordPress Sites Using Really Simple Security Free and Pro Versions Affected by Critical Authentication Bypass Vulnerability
On November 6th, 2024, our Wordfence Threat Intelligence team identified and began the responsible disclosure process for an Authentication Bypass vulnerability in the Really Simple Security plugin, and in the Really Simple Security Pro and Pro Multisite plugins, which are actively installed on more than 4,000,000 WordPress websites. The Really Simple Security (Free, Pro, and Pro Multisite) plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1.

News

WordPress Really Simple Security Authentication Bypass
Authored by Antonio Francesco Sardella Site github.com WordPress Really Simple Security plugin versions prior to 9.1.2 proof of concept authentication bypass exploit. advisories CVE-2024-10924
WordPress Plug-In Vulnerability Threatens 4 Million Sites
"We urge users to verify that their sites were updated to the latest patched version of Really Simple Security, version 9.1.2," Wordfence researchers wrote. The critical authentication bypass vulnerability takes advantage of a now-patched flaw in the Really Simple Security plug-in, active across more than 4 million websites.
CVE-2024-10924 Explained: Security plugin flaw in millions of WordPress sites
The Really Simple Security (Free, Pro, and Pro Multisite) plugin for WordPress is vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1 when the “Two-Factor Authentication” setting is enabled. A critical authentication bypass vulnerability has been identified in the WordPress plugin Really Simple Security (formerly known as Really Simple SSL ), affecting both its free and Pro versions.
CVE-2024-10924 (2024-11-15) m3ssap0/wordpress-really-simple-security-authn-bypass-exploit
This is a Python3 program that exploits Really Simple Security < 9.1.2 authentication bypass vulnerability (CVE-2024-10924). Please use this tool responsibly.
🚨 CVE-2024-10924 🚨 A critical vulnerability (CVSS 9.8) in # ReallySimpleSecurity for # WordPress allows attackers to bypass authentication and log in as admin when 2FA is enabled. 👉 Fix: Update to v9.1.2 🧠 Read our annotated article: https:// basefortify.eu/cve_reports/202 4/11/cve-2024-10924.html # Cybersecurity # CVE
See 88 more articles and social media posts

CVSS V3.1

Attack Vector:Network
Attack Complexity:Low
Privileges Required:None
User Interaction:None
Scope:Unchanged
Confidentiality:High
Integrity:High
Availability Impact:High

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI