CVE-2024-10924: Really Simple Security Auth Bypass Flaw

CVE-2024-10924 Overview

The Really Simple Security (Free, Pro, and Pro Multisite) plugins for WordPress are vulnerable to an authentication bypass in versions 9.0.0 to 9.1.1.1. This vulnerability is due to improper user check error handling in the two-factor REST API actions with the check_login_and_get_user function. This defect allows unauthenticated attackers to log in as any existing user on the site, potentially escalating privileges to an administrator when the "Two-Factor Authentication" setting is enabled (which is disabled by default).

Critical Impact

This vulnerability allows unauthenticated attackers to gain access to high-privilege accounts on affected WordPress sites.

Affected Products

• really-simple-plugins:really_simple_security
• really-simple-plugins:really_simple_security:pro
• really-simple-plugins:really_simple_security:pro_multisite

Discovery Timeline

• Not Available - Vulnerability discovered by Not Available
• Not Available - Responsible disclosure to really-simple-plugins
• Not Available - CVE CVE-2024-10924 assigned
• Not Available - really-simple-plugins releases security patch
• 2024-11-15 - CVE CVE-2024-10924 published to NVD
• 2024-11-20 - Last updated in NVD database

Technical Details for CVE-2024-10924

Vulnerability Analysis

This authentication bypass is a result of improper implementation in the handling of authentication checks within the WordPress REST API. The failure to adequately validate user identity in the check_login_and_get_user function allows attackers to impersonate other users, leading to unauthorized access.

Root Cause

The root cause lies in the lack of thorough error handling in the REST API's authentication logic, specifically in the user verification code.

Attack Vector

This vulnerability can be exploited over the network by malicious actors who need no prior authentication, assuming they can access the vulnerable endpoint.

# Example exploitation code (sanitized)
import requests

def exploit(url):
    response = requests.post(f"{url}/wp-json/two-factor/check_login_and_get_user")
    if response.status_code == 200:
        print("Successfully bypassed authentication!")
    else:
        print("Attack failed.")

exploit("http://vulnerable-site.com")

Detection Methods for CVE-2024-10924

Indicators of Compromise

• Unrecognized login events
• Suspicious admin account access
• Multiple failed login attempts from unknown sources

Detection Strategies

Monitoring REST API interactions for anomalous behavior and login attempts from suspect IP addresses can signal the exploitation of this vulnerability.

Monitoring Recommendations

Employ a WAF (Web Application Firewall) to monitor and block unauthorized login requests and consider integrating SentinelOne’s threat detection solution to flag unusual account activities.

How to Mitigate CVE-2024-10924

Immediate Actions Required

• Disable the "Two-Factor Authentication" setting if not essential.
• Monitor user login activity closely.
• Utilize logging to track and review authentication events.

Patch Information

Ensure that the Really Simple Security plugin is updated to the latest patched version as per the vendor advisory.

Workarounds

If immediate patching is not feasible, consider restricting access to the REST API endpoints using .htaccess or equivalent methods to allow only trusted IP addresses.

# Configuration example
<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteCond %{REQUEST_URI} ^/wp-json/two-factor/ [NC]
  RewriteCond %{REMOTE_ADDR} !^123\.456\.789\.0$
  RewriteRule .* - [F,L]
</IfModule>