SiteGuard WP Plugin <= 1.7.6 - Login Page Disclosure

id: CVE-2024-37881

info:
  name: SiteGuard WP Plugin <= 1.7.6 - Login Page Disclosure
  author: s4e-io
  severity: medium
  description: |
    The SiteGuard WP Plugin plugin for WordPress is vulnerable to protection mechanism bypass in all versions up to, and including, 1.7.6. This is due to the plugin not restricting redirects from wp-register.php which may disclose the login page URL. This makes it possible for unauthenticated attackers to gain access to the login page.
  impact: |
    Unauthenticated attackers can discover the actual login page URL despite protection mechanisms, facilitating brute force attacks or targeted exploitation of the WordPress login interface.
  remediation: |
    Upgrade to SiteGuard WP Plugin version 1.7.7 or later.
  reference:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-37881
    - https://jvn.jp/en/jp/JVN60331535/
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/siteguard/siteguard-wp-plugin-176-login-page-disclosure
    - https://www.usom.gov.tr/bildirim/tr-24-0726
  classification:
    epss-score: 0.01174
    epss-percentile: 0.63808
  metadata:
    verified: true
    max-request: 1
    publicwww-query: "/wp-content/plugins/siteguard/"
  tags: cve,cve2024,siteguard,wp-plugin,vuln

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/siteguard/readme.txt"

    matchers:
      - type: dsl
        internal: true
        dsl:
          - "status_code == 200"
          - 'contains(body, "SiteGuard WP Plugin")'
        condition: and

  - method: GET
    path:
      - "{{BaseURL}}/wp-register.php"

    matchers:
      - type: dsl
        dsl:
          - "status_code == 301 || status_code == 302"
          - "!contains(tolower(location), 'wp-login.php')"
          - "!contains(tolower(location), 'wp-register.php')"
          - "!contains(tolower(location), 'notfound')"
          - "!contains(tolower(location), 'not-found')"
          - "!contains(tolower(location), '/404')"
        condition: and

    extractors:
      - type: kval
        kval:
          - location
# digest: 490a004630440220521eaa72e3d08d5cc92606908ff2e1febe5db28dc2f74d4fce3f6df0042183fc022041acb51f66e9a4705ddd09db29864eaf806bf55c0e10b4be1e96eac10035998c:922c64590222798bb761d5b6d8e72950