CVE-2024-9707

Missing Authorization (CWE-862)

Published: Oct 11, 2024 / Updated: 39d ago

010
CVSS 9.8EPSS 0.06%Critical
CVE info copied to clipboard

Summary

The Hunk Companion plugin for WordPress is vulnerable to unauthorized plugin installation/activation due to a missing capability check on the /wp-json/hc/v1/themehunk-import REST API endpoint in all versions up to, and including, 1.8.4. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins.

Impact

This vulnerability can be leveraged to achieve remote code execution if another vulnerable plugin is installed and activated. The impact is severe, with potential for high confidentiality, integrity, and availability breaches. Unauthenticated attackers can exploit this vulnerability over the network without user interaction, potentially leading to full system compromise.

Exploitation

There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.

Patch

A patch is not explicitly mentioned in the provided information. However, given that the vulnerability affects "all versions up to, and including, 1.8.4" of the Hunk Companion plugin, it's likely that a patched version higher than 1.8.4 may be available or forthcoming.

Mitigation

1. Immediately update the Hunk Companion plugin to a version higher than 1.8.4 if available. 2. If an update is not available, consider disabling or removing the Hunk Companion plugin until a patch is released. 3. Implement strong access controls and monitor for unauthorized plugin installations or activations. 4. Regularly audit and update all WordPress plugins to minimize the risk of having other vulnerable plugins that could be exploited in conjunction with this vulnerability. 5. Consider implementing web application firewall (WAF) rules to block potentially malicious requests to the vulnerable endpoint (/wp-json/hc/v1/themehunk-import).

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Timeline

First Article

Feedly found the first article mentioning CVE-2024-9707. See article

Oct 11, 2024 at 6:58 AM / Vulners.com RSS Feed
CVSS Estimate

Feedly estimated the CVSS score as HIGH

Oct 11, 2024 at 6:58 AM
CVE Assignment

NVD published the first details for CVE-2024-9707

Oct 11, 2024 at 1:15 PM
CVSS

A CVSS base score of 9.8 has been assigned.

Oct 11, 2024 at 1:20 PM / nvd
Threat Intelligence Report

CVE-2024-9707 is a critical vulnerability in the Hunk Companion plugin for WordPress, with a CVSS score of 9.8, allowing unauthorized installation and activation of plugins due to a missing capability check on the REST API endpoint. Currently, there is no evidence of exploitation in the wild or public proof-of-concept exploits, but the potential for severe impacts, including remote code execution, exists if other vulnerable plugins are present. Mitigations include updating the plugin to a version higher than 1.8.4, disabling it if no update is available, and implementing strong access controls and monitoring. See article

Oct 12, 2024 at 2:31 AM
EPSS

EPSS Score was set to: 0.06% (Percentile: 27.9%)

Oct 12, 2024 at 10:55 AM
Detection in Vulnerability Scanners

Detection for the vulnerability has been added to Qualys (152312)

Oct 16, 2024 at 7:53 AM
Static CVE Timeline Graph

Affected Systems

Wordpress/wordpress
+null more

Links to Mitre Att&cks

T1495: Firmware Corruption
+null more

Attack Patterns

CAPEC-665: Exploitation of Thunderbolt Protection Flaws
+null more

News

Web Application Detections Published in October 2024
In October, Qualys released QIDs targeting vulnerabilities in several widely used software products, including WordPress, Zohocorp ManageEngine Endpoint, Lobe Chat, Ivanti Virtual Traffic Manager (vTM), Traefik, Nginx Proxy Manager, Harbor, Haproxy, SolarWinds Access Rights Manager (ARM), Cacti, Ivanti Endpoint Manager Mobile (EPMM), JetBrains TeamCity, Palo Alto Networks Expedition, Progress Telerik Report Server, Zimbra, Oracle WebLogic Server, Apache Solr, FlatPress CMS, pgAdmin, Grafana, pfSense, SolarWinds Web Help Desk, Ivanti Avalanche, ReCrystallize Server, Joomla!, and PHP. The QIDs released to detect the vulnerabilities in the frameworks above are listed below. Details about the following QIDs can be found in our knowledge base. Please review reports of the scanned applications for these detections and, if any are identified follow the steps provided in the knowledge base to ensure applications are protected against the reported vulnerabilities. QID Title 152202 Zohocorp ManageEngine Endpoint Central Incorrect Authorization Vulnerability (CVE-2024-38868) 152206 WordPress Delicious Recipe Plugin: Arbitrary File Movement and Reading Vulnerability (CVE-2024-7626) 152207 WordPress Simple Spoiler Plugin: Arbitrary Shortcode Execution Vulnerability (CVE-2024-8479) 152209 WordPress PropertyHive Plugin: Cross-Site Request Forgery Vulnerability (CVE-2024-8490) 152210 WordPress Share This Image Plugin: Open Redirect Vulnerability (CVE-2024-8761) 152215 WordPress infolinks Ad Wrap Plugin: Cross-Site Request Forgery Vulnerability (CVE-2024-8044) 152216 WordPress Bit File Manager Plugin:
Update Sun Oct 27 14:34:00 UTC 2024
Update Sun Oct 27 14:34:00 UTC 2024
https:// github.com/RandomRobbieBF/CVE- 2024-9707 # wordpress
RandomRobbieBF/CVE-2024-9707
[GitHub]Hunk Companion <=1.8.4 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation/Activation
Wordfence Intelligence Weekly WordPress Vulnerability Report (October 7, 2024 to October 13, 2024)
WordPress Plugins with Reported Vulnerabilities Last Week The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:
See 12 more articles and social media posts

CVSS V3.1

Attack Vector:Network
Attack Complexity:Low
Privileges Required:None
User Interaction:None
Scope:Unchanged
Confidentiality:High
Integrity:High
Availability Impact:High

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI