CVE-2024-9821

Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)

Published: Oct 12, 2024 / Updated: 39d ago

010
CVSS 8.8EPSS 0.05%High
CVE info copied to clipboard

Summary

The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to sensitive information disclosure due to missing authorization checks on the 'stm_wpcfto_get_settings' AJAX action in all versions up to, and including, 1.2.4. This vulnerability allows authenticated attackers with subscriber-level access or higher to view the Telegram Bot Token, a secret token used to control the bot.

Impact

The exploitation of this vulnerability can have severe consequences. An attacker who obtains the Telegram Bot Token can use it to log in as any existing user on the site, including administrators, if they know the username. This is possible due to the Login with Telegram feature. This level of access could lead to complete compromise of the WordPress site, potentially allowing attackers to modify content, install malicious plugins, or steal sensitive data.

Exploitation

There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.

Patch

A patch is not explicitly mentioned in the provided information. However, given that the vulnerability affects "all versions up to, and including, 1.2.4" of the Bot for Telegram on WooCommerce plugin, it's likely that a patched version (1.2.5 or higher) may be available or forthcoming. Site administrators should check for updates to this plugin and apply them as soon as they become available.

Mitigation

1. Update the Bot for Telegram on WooCommerce plugin to a version higher than 1.2.4 if available. 2. If an update is not available, consider temporarily disabling the plugin until a patch is released. 3. Implement strong user authentication and access controls to limit the number of users with subscriber-level access or higher. 4. Regularly audit user accounts and remove unnecessary privileges. 5. Monitor for any suspicious activities related to the Telegram bot or unexpected login attempts. 6. Consider implementing additional security layers, such as two-factor authentication, to protect administrator accounts. 7. Regularly rotate the Telegram Bot Token as a precautionary measure.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Timeline

First Article

Feedly found the first article mentioning CVE-2024-9821. See article

Oct 11, 2024 at 5:08 PM / #infosec
CVSS Estimate

Feedly estimated the CVSS score as MEDIUM

Oct 11, 2024 at 5:08 PM
CVE Assignment

NVD published the first details for CVE-2024-9821

Oct 12, 2024 at 3:15 AM
CVSS

A CVSS base score of 8.8 has been assigned.

Oct 12, 2024 at 3:15 AM / nvd
EPSS

EPSS Score was set to: 0.05% (Percentile: 20.2%)

Oct 12, 2024 at 10:03 AM
Detection in Vulnerability Scanners

Detection for the vulnerability has been added to Qualys (152306)

Oct 15, 2024 at 7:53 AM
Static CVE Timeline Graph

Affected Systems

Wordpress/wordpress
+null more

Links to Mitre Att&cks

T1562.003: Impair Command History Logging
+null more

Attack Patterns

CAPEC-116: Excavation
+null more

News

Web Application Detections Published in October 2024
In October, Qualys released QIDs targeting vulnerabilities in several widely used software products, including WordPress, Zohocorp ManageEngine Endpoint, Lobe Chat, Ivanti Virtual Traffic Manager (vTM), Traefik, Nginx Proxy Manager, Harbor, Haproxy, SolarWinds Access Rights Manager (ARM), Cacti, Ivanti Endpoint Manager Mobile (EPMM), JetBrains TeamCity, Palo Alto Networks Expedition, Progress Telerik Report Server, Zimbra, Oracle WebLogic Server, Apache Solr, FlatPress CMS, pgAdmin, Grafana, pfSense, SolarWinds Web Help Desk, Ivanti Avalanche, ReCrystallize Server, Joomla!, and PHP. The QIDs released to detect the vulnerabilities in the frameworks above are listed below. Details about the following QIDs can be found in our knowledge base. Please review reports of the scanned applications for these detections and, if any are identified follow the steps provided in the knowledge base to ensure applications are protected against the reported vulnerabilities. QID Title 152202 Zohocorp ManageEngine Endpoint Central Incorrect Authorization Vulnerability (CVE-2024-38868) 152206 WordPress Delicious Recipe Plugin: Arbitrary File Movement and Reading Vulnerability (CVE-2024-7626) 152207 WordPress Simple Spoiler Plugin: Arbitrary Shortcode Execution Vulnerability (CVE-2024-8479) 152209 WordPress PropertyHive Plugin: Cross-Site Request Forgery Vulnerability (CVE-2024-8490) 152210 WordPress Share This Image Plugin: Open Redirect Vulnerability (CVE-2024-8761) 152215 WordPress infolinks Ad Wrap Plugin: Cross-Site Request Forgery Vulnerability (CVE-2024-8044) 152216 WordPress Bit File Manager Plugin:
Vulnerability Summary for the Week of October 7, 2024
High Vulnerabilities Primary Vendor — Product Description Published CVSS Score Source Info Patch Info adobe — animate Animate versions 23.0.7, 24.0.4 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-10-09 7.8 CVE-2024-47410 psirt@adobe.com adobe — animate Animate versions 23.0.7, 24.0.4 and earlier are affected by an Access of Uninitialized Pointer vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-10-09 7.8 CVE-2024-47411 psirt@adobe.com adobe — animate Animate versions 23.0.7, 24.0.4 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-10-09 7.8 CVE-2024-47412 psirt@adobe.com adobe — animate Animate versions 23.0.7, 24.0.4 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-10-09 7.8 CVE-2024-47413 psirt@adobe.com adobe — animate Animate versions 23.0.7, 24.0.4 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
https:// github.com/RandomRobbieBF/CVE- 2024-9821 # wordpress
Wordfence Intelligence Weekly WordPress Vulnerability Report (October 7, 2024 to October 13, 2024)
WordPress Plugins with Reported Vulnerabilities Last Week The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:
Security Bulletin 16 Oct 2024 - Cyber Security Agency of Singapore
https:// nvd . nist .gov/vuln/detail/ CVE -2024-9985. CVE -2024-47875, DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML ...
See 18 more articles and social media posts

CVSS V3.1

Attack Vector:Network
Attack Complexity:Low
Privileges Required:Low
User Interaction:None
Scope:Unchanged
Confidentiality:High
Integrity:High
Availability Impact:High

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI