id: CVE-2023-5089

info:
  name: Defender Security < 4.1.0 - Protection Bypass (Hidden Login Page)
  author: jpg0mez
  severity: medium
  description: |
    The Defender Security WordPress plugin before 4.1.0 does not prevent redirects to the login page via the auth_redirect WordPress function, allowing an unauthenticated visitor to access the login page, even when the hide login page functionality of the plugin is enabled.
  remediation: Fixed in 4.1.0
  reference:
    - https://www.sprocketsecurity.com/resources/discovering-wp-admin-urls-in-wordpress-with-gravityforms
    - https://wpscan.com/vulnerability/2b547488-187b-44bc-a57d-f876a7d4c87d/
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5089
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2023-5089
    epss-score: 0.00306
    epss-percentile: 0.6923
    cpe: cpe:2.3:a:wpmudev:defender_security:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: wpmudev
    product: defender_security
    framework: wordpress
    publicwww-query: "/wp-content/plugins/defender-security/"
  tags: cve,cve2023,wordpress,wpscan,wp-plugin,defender-security,redirect

http:
  - method: GET
    path:
      - "{{BaseURL}}/?gf_page=randomstring"

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - "!contains(tolower(location), 'wp-login.php')"

      - type: word
        part: header
        words:
          - '%2F%3Fgf_page%3Drandomstring&reauth=1'

    extractors:
      - type: kval
        kval:
          - location
# digest: 490a0046304402206b16a89c762de085efbd0eb938dc018feaf844ac63c97a3238ab539451a6c45d02204334566c717d59890bef90680d58efff1ffaabb51f8f1f0beb8e0c0f0cc253dd:922c64590222798bb761d5b6d8e72950