Really Simple Security plugin flaw impacts 4M+ WordPress sites
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-10924 | Unauthenticated Authentication Bypass in Really Simple Security WordPress Plugin CVE-2024-10924 is a critical (CVSS 9.8) unauthenticated authentication bypass in the Really Simple Security plugin for WordPress (Free, Pro, and Pro Multisite editions), affecting versions 9.0.0 through 9.1.1.1. It stems from improper user check error handling in the 'check_login_and_get_user' function used by the two-factor REST API actions, and can be triggered when the plugin's 'Two-Factor Authentication' setting is enabled (it is disabled by default). An unauthenticated attacker can exploit it to log in as any existing user on the site, including an administrator, gaining full control of the affected WordPress site. Any WordPress site running one of the affected plugin versions with two-factor authentication turned on is exposed, and public reporting indicates the plugin is installed on more than 4 million sites. As of the latest data there is no confirmed in-the-wild exploitation, no public proof-of-concept, and it is not in CISA's KEV catalog, but EPSS assigns an 82% probability of exploitation within the next 30 days (99th+ percentile), so rapid patching is warranted. Do: Update the Really Simple Security plugin to a fixed release (any version after 9.1.1.1) on all Free, Pro, and Pro Multisite installations. As an interim mitigation, disable the 'Two-Factor Authentication' setting or restrict access to the WordPress REST API until patched. After updating, review recent authentication logs and administrator accounts for signs of unauthorized logins. | 9.8 | 82% |
| mass≈4,000,000+ WordPress sites install the plugin, though only the subset with Two-Factor Authentication enabled is directly exploitable |
Full article492 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
November 18, 2024
A Really Simple Security plugin flaw affects 4M+ sites, allowing attackers full admin access. It’s one of the most critical WordPress vulnerabilities ever.
Wordfence researchers warn of a vulnerability, tracked as CVE-2024-10924 (CVSS Score of 9.8), in the Really Simple Security plugin that affects 4M+ sites. The Really Simple Security plugin, formerly Really Simple SSL, is a popular WordPress tool that enhances website security with features like login protection, vulnerability detection, and two-factor authentication. Wordfence’s researcher István Márton discovered the vulnerability on November 6, 2024.
According to the researchers, this is one of the most serious vulnerabilities they have discovered in their 12-year activity. This vulnerability affects Really Simple Security, formerly known as Really Simple SSL, installed on over 4 million websites, and allows an attacker to remotely gain full administrative access to a site running the plugin.
The vulnerability is an authentication bypass vulnerability in the Really Simple Security plugin, and in the Really Simple Security Pro and Pro Multisite plugins. An attacker could exploit the vulnerability to remotely gain access to any account on the site, including the administrator account, when the two-factor authentication feature is enabled.
The Really Simple Security plugin, formerly Really Simple SSL, introduced two-factor authentication in its latest update, but its implementation is not secure.
The flaw is due to improper user check error handling in the two-factor REST API actions with the ‘check_login_and_get_user’ function.
The researchers warned that the vulnerability is scriptable allowing attackers to automate its exploitation in a large-scale automated attack.
“The check_login_and_get_user() function verifies the user using the user_id and login_nonce parameters.
The most significant problem and vulnerability is caused by the fact that the function returns a WP_REST_Response error in case of a failure, but this is not handled within the function. This means that even in the case of an invalid nonce, the function processing continues and invokes authenticate_and_redirect(), which authenticates the user based on the user id passed in the request, even when that user’s identity hasn’t been verified.” reads the advisory.
“Ultimately, this makes it possible for threat actors to bypass authentication and gain access to arbitrary accounts on sites running a vulnerable version of the plugin. As always, authentication bypass vulnerabilities and resulting access to high privileged user accounts, make it easy for threat actors to completely compromise a vulnerable WordPress site and further infect it.”
This vulnerability only impacts WordPress sites who have enabled “Two-Factor Authentication” in the plugin settings.
CVE-2024-10924 impacts plugin versions from 9.0.0 and up to 9.1.1.1 of the “free,” “Pro,” and “Pro Multisite” releases. The flaw has been fixed in version 9.1.2. Security updates were released on November 12 (Pro version) and November 14 (free users). WordPress.org coordinated force updates for most users, but admins should verify they are on the latest version.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Really Simple Security plugin)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/171100/hacking/really-simple-security-plugin-flaw-affects-4m-sites.html