CVE-2024-10924
Really Simple Security for WordPress Authentication Bypass
Description
The Really Simple Security (Free, Pro, and Pro Multisite) plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. This is due to improper user check error handling in the two-factor REST API actions with the 'check_login_and_get_user' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, when the "Two-Factor Authentication" setting is enabled (disabled by default).
INFO
Published Date :
Nov. 15, 2024, 4:15 a.m.
Last Modified :
Nov. 20, 2024, 2:44 p.m.
Source :
[email protected]
Remotely Exploitable :
Yes !
Impact Score :
5.9
Exploitability Score :
3.9
Public PoC/Exploit Available at Github
CVE-2024-10924 has a 16 public PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2024-10924.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
None
Python
None
Dockerfile Shell PHP CSS SCSS JavaScript HTML Less
None
Python
None
bypass bypass-wordpress cibersecurity cve cve-2024-10924 exploit hacking hacking-etico really-simple-security wordpress bypass-mfa
Python
Bypass del MFA en WordPress con el plugin Really Simple Security instalado entre las versiones 9.0.0 – 9.1.1.1.
Python
Exploit for CVE-2024-10924 -> Really Simple Security < 9.1.2 authentication bypass
Vulnerable docker container for Really Simple Security (Free, Pro, and Pro Multisite) 9.0.0 – 9.1.1.1 – Authentication Bypass CVE-2023-50164
Dockerfile Shell PHP CSS SCSS JavaScript HTML Less
POC for CVE-2024-10924 written in Python
cve-2024-10924 python really-simple-security wordpress
Python
Exploits Really Simple Security < 9.1.2 authentication bypass (CVE-2024-10924).
cve-2024-10924 exploit really-simple-security security security-tools vulnerability vulnerability-scan wordpress
Python
Simple Python script
Python
WARNING: This is a vulnerable application to test the exploit for the Really Simple Security < 9.1.2 authentication bypass (CVE-2024-10924). Run it at your own risk!
authentication-bypass vulnerable-application wordpress cve-2024-10924 really-simple-security
Dockerfile Shell
CVE-2024-10924 Authentication Bypass Using an Alternate Path or Channel (CWE-288)
Really Simple Security (Free, Pro, and Pro Multisite) 9.0.0 – 9.1.1.1 – Authentication Bypass
None
Ostorlab KEV: One-command to detect most remotely known exploitable vulnerabilities. Sourced from CISA KEV, Google's Tsunami, Ostorlab's Asteroid and Bug Bounty programs.
cisa-kev vulnerability 0day cisa exploits
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2024-10924 vulnerability anywhere in the article.
-
Cybersecurity News
Researchers Uncover XenoRAT’s New Tactics Leveraging Excel XLL Files and Advanced Obfuscation
Hunt researchers have discovered a novel deployment of XenoRAT, an open-source remote access tool (RAT), leveraging Excel XLL files and advanced obfuscation methods. Known for targeting gamers and pos ... Read more
-
Kaspersky
CVE-2024-10924, authentication bypass vulnerability in WordPress
Bad news for companies using WordPress sites with a two-factor authentication mechanism implemented via the Really Simple Security plugin. The recently discovered CVE-2024-10924 vulnerability in this ... Read more
-
The Hacker News
Urgent: Critical WordPress Plugin Vulnerability Exposes Over 4 Million Sites
Vulnerability / Website Security A critical authentication bypass vulnerability has been disclosed in the Really Simple Security (formerly Really Simple SSL) plugin for WordPress that, if successfully ... Read more
-
BleepingComputer
Security plugin flaw in millions of WordPress sites gives admin access
A critical authentication bypass vulnerability has been discovered impacting the WordPress plugin 'Really Simple Security' (formerly 'Really Simple SSL'), including both free and Pro versions. Really ... Read more
-
Cybersecurity News
CVE-2024-10924 (CVSS 9.8): Authentication Bypass in Really Simple Security Plugin Affects 4 Million Sites
The Wordfence Threat Intelligence team identified a severe authentication bypass vulnerability (CVE-2024-10924) in the Really Simple Security plugin, including its Pro and Pro Multisite versions. This ... Read more
-
security.nl
WordPress.org forceert update wegens kritiek lek in Really Simple Security
Een kritieke kwetsbaarheid in Really Simple Security, een plug-in voor WordPress, maakt het mogelijk om websites op afstand over te nemen. Vanwege de impact heeft WordPress.org besloten om de update, ... Read more
The following table lists the changes that have been made to the
CVE-2024-10924 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Nov. 20, 2024
Action Type Old Value New Value Added CVSS V3.1 NIST AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Changed Reference Type https://plugins.trac.wordpress.org/browser/really-simple-ssl/tags/9.1.1.1/security/wordpress/two-fa/class-rsssl-two-factor-on-board-api.php#L277 No Types Assigned https://plugins.trac.wordpress.org/browser/really-simple-ssl/tags/9.1.1.1/security/wordpress/two-fa/class-rsssl-two-factor-on-board-api.php#L277 Product Changed Reference Type https://plugins.trac.wordpress.org/browser/really-simple-ssl/tags/9.1.1.1/security/wordpress/two-fa/class-rsssl-two-factor-on-board-api.php#L278 No Types Assigned https://plugins.trac.wordpress.org/browser/really-simple-ssl/tags/9.1.1.1/security/wordpress/two-fa/class-rsssl-two-factor-on-board-api.php#L278 Product Changed Reference Type https://plugins.trac.wordpress.org/browser/really-simple-ssl/tags/9.1.1.1/security/wordpress/two-fa/class-rsssl-two-factor-on-board-api.php#L67 No Types Assigned https://plugins.trac.wordpress.org/browser/really-simple-ssl/tags/9.1.1.1/security/wordpress/two-fa/class-rsssl-two-factor-on-board-api.php#L67 Product Changed Reference Type https://plugins.trac.wordpress.org/changeset/3188431/really-simple-ssl No Types Assigned https://plugins.trac.wordpress.org/changeset/3188431/really-simple-ssl Patch Changed Reference Type https://www.wordfence.com/blog/2024/11/really-simple-security-vulnerability/ No Types Assigned https://www.wordfence.com/blog/2024/11/really-simple-security-vulnerability/ Third Party Advisory Changed Reference Type https://www.wordfence.com/threat-intel/vulnerabilities/id/7d5d05ad-1a7a-43d2-bbbf-597e975446be?source=cve No Types Assigned https://www.wordfence.com/threat-intel/vulnerabilities/id/7d5d05ad-1a7a-43d2-bbbf-597e975446be?source=cve Third Party Advisory Added CWE NIST CWE-306 Added CPE Configuration OR *cpe:2.3:a:really-simple-plugins:really_simple_security:*:*:*:*:-:wordpress:*:* versions from (including) 9.0.0 up to (excluding) 9.1.2 *cpe:2.3:a:really-simple-plugins:really_simple_security:*:*:*:*:pro:wordpress:*:* versions from (including) 9.0.0 up to (excluding) 9.1.2 *cpe:2.3:a:really-simple-plugins:really_simple_security:*:*:*:*:pro_multisite:wordpress:*:* versions from (including) 9.0.0 up to (excluding) 9.1.2 -
CVE Modified by [email protected]
Nov. 19, 2024
Action Type Old Value New Value Added Reference Wordfence https://www.wordfence.com/blog/2024/11/really-simple-security-vulnerability/ [No types assigned] -
CVE Received by [email protected]
Nov. 15, 2024
Action Type Old Value New Value Added Description The Really Simple Security (Free, Pro, and Pro Multisite) plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. This is due to improper user check error handling in the two-factor REST API actions with the 'check_login_and_get_user' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, when the "Two-Factor Authentication" setting is enabled (disabled by default). Added Reference Wordfence https://www.wordfence.com/threat-intel/vulnerabilities/id/7d5d05ad-1a7a-43d2-bbbf-597e975446be?source=cve [No types assigned] Added Reference Wordfence https://plugins.trac.wordpress.org/browser/really-simple-ssl/tags/9.1.1.1/security/wordpress/two-fa/class-rsssl-two-factor-on-board-api.php#L67 [No types assigned] Added Reference Wordfence https://plugins.trac.wordpress.org/browser/really-simple-ssl/tags/9.1.1.1/security/wordpress/two-fa/class-rsssl-two-factor-on-board-api.php#L277 [No types assigned] Added Reference Wordfence https://plugins.trac.wordpress.org/browser/really-simple-ssl/tags/9.1.1.1/security/wordpress/two-fa/class-rsssl-two-factor-on-board-api.php#L278 [No types assigned] Added Reference Wordfence https://plugins.trac.wordpress.org/changeset/3188431/really-simple-ssl [No types assigned] Added CWE Wordfence CWE-288 Added CVSS V3.1 Wordfence AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2024-10924 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2024-10924
weaknesses.