CVE-2024-10924 PoC — Really Simple Security (Free, Pro, and Pro Multisite) 9.0.0 - 9.1.1.1 - Authentication Bypass

Source

https://github.com/Hunt3r850/CVE-2024-10924-PoC

Associated Vulnerability

Title:Really Simple Security (Free, Pro, and Pro Multisite) 9.0.0 - 9.1.1.1 - Authentication Bypass (CVE-2024-10924)
Description:The Really Simple Security (Free, Pro, and Pro Multisite) plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. This is due to improper user check error handling in the two-factor REST API actions with the 'check_login_and_get_user' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, when the "Two-Factor Authentication" setting is enabled (disabled by default).

Readme

# PoC Authentication Bypass MFA Really Simple Security WordPress Plugin | CVE-2024-10924

Accedemos a la página web de wordpress donde veremos que tiene MFA activado a través del plugin vulnerable:

![imagen](https://github.com/user-attachments/assets/0b6b5736-e7aa-45ba-b6f4-d2db7a45d9ee)

Debemos ejecutar la PoC y proporcionar los datos de acceso:


![imagen](https://github.com/user-attachments/assets/c551b296-6835-49b3-b844-4d532e4b53e2)

De forma automática, se abrirá el navegador mediante un archivo temporal .html dentro del panel de administración.

![imagen](https://github.com/user-attachments/assets/2de116bb-302b-4d6b-b12d-d986b162e9ee)

Para desplegar automáticamente un entorno vulnerable donde recrear este escenario, se puede utilizar el siguiente repositorio:

https://github.com/Trackflaw/CVE-2024-10924-Wordpress-Docker

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →