CVE-2023-6036 PoC — WordPress Plugin Web3 安全漏洞

Source

https://github.com/pctripsesp/CVE-2023-6036

Associated Vulnerability

Title:WordPress Plugin Web3 安全漏洞 (CVE-2023-6036)
Description:WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress plugin是一个应用插件。 WordPress Plugin Web3 3.0.0 版本之前存在安全漏洞，该漏洞源于函数 handle_auth_request 和 hadle_login_request 中登录流程中的身份验证检查不正确，因此容易受到身份验证绕过的影响。

Description

POC about Web3 – Crypto wallet Login & NFT token gating < 3.0.0 - Authentication Bypass Wordpress plugin

Readme

# CVE-2023-6036
POC about Wordpress plugin _Web3 – Crypto wallet Login &amp; NFT token gating &lt; 3.0.0 - Authentication Bypass_


This vulnerability is about authentication bypass due incorrect authentication checking in the ‘handle_login_request’ function and ‘handle_auth_request' function



## Vulnerability

I have divided login flow in 3 steps, that are actually 3 different POST when login through our web3 wallet.

### 1. handle_login_request
![](img/1.png)

![](img/2.png)

With this POST request, anybody can retrieve an existing user nonce, so you can get admin user’s nonce just by knowing his username or wallet, replacing param “address” with it’s username and making the POST request.

Then, you can drop the second login POST, as this only checks if the signature of the nonce is correct or not, but it’s issolated from the login flow.


### 2. handle_auth_request
![](img/3.png)

![](img/4.png)

In the 3 step, you can make the login just by sending:

• target username

• target nonce (from step 1)

• public wp nonce


### 3. hidden_form_data

![](img/5.png)

![](img/6.png)

So basically don’t check that the user is trying to login in the 3 step is the same user that make the signature in step 2; and anybody can bypass the auth login and pontetially do it as an admin user.


## References

https://wpscan.com/vulnerability/7f30ab20-805b-422c-a9a5-21d39c570ee4

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6036

https://www.udemy.com/course/0-day-wordpress/?referralCode=7039562B316447367B85

File Snapshot


 [4.0K]  /data/pocs/ddd67221b53dac34b1ca78065cba178ae354f97f
├── [2.0K]  CVE-2023-6036.py
├── [4.0K]  img
│   ├── [194K]  1.png
│   ├── [ 96K]  2.png
│   ├── [ 91K]  3.png
│   ├── [361K]  4.png
│   ├── [151K]  5.png
│   └── [574K]  6.png
├── [ 756]  nuclei_template.yaml
└── [1.5K]  README.md

1 directory, 9 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!