Stop User Enumeration Plugin 1.3.4 on WordPress privileges management

Summaryinfo

A vulnerability labeled as critical has been found in Stop User Enumeration Plugin 1.3.4 on WordPress. This affects an unknown part. Such manipulation leads to privileges management. The attack can be launched remotely. Moreover, an exploit is present. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Stop User Enumeration Plugin 1.3.4 on WordPress (WordPress Plugin). Affected by this issue is an unknown part. The manipulation with an unknown input leads to a privileges management vulnerability. Using CWE to declare the problem leads to CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. Impacted is confidentiality.

The bug was discovered 12/23/2016. The weakness was disclosed 01/04/2017 by Tom Adams as Stop User Enumeration does not stop user enumeration (WordPress plugin) as confirmed mailinglist post (Full-Disclosure). The advisory is available at seclists.org. The public release has been coordinated in cooperation with the vendor. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Technical details are unknown but a public exploit is available. This vulnerability is assigned to T1068 by the MITRE ATT&CK project. The advisory points out:

Traditionally user enumeration of a WordPress site is done by making a series of requests to /?author=1 /?author=2 /?author=3 and so on (a similar effect can be achieved using POST requests too). WordPress 4.7 introduced a REST API endpoint to list all users. This plugin attempts to prevent requests with an author parameter (but fails), and makes no attempt at preventing requests to the REST API.

A public exploit has been developed by Tom Adams in URL and been published immediately after the advisory. The exploit is available at security.dxw.com. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 11 days. During that time the estimated underground price was around $0-$5k. The code used by the exploit is:

curl -i -s 'http://localhost/?wp-comments-post&author=1'

Upgrading to version 1.3.5 eliminates this vulnerability. A possible mitigation has been published even before and not after the disclosure of the vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• WordPress Plugin

Name

• Stop User Enumeration Plugin

Version

• 1.3.4

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion