微信二维码登陆插件权限验证绕过漏洞

Executive Summary

This vulnerability affects the 'QRcode Login for WeChat' WordPress plugin version 1.3 or below. It allows an unauthenticated attacker to bypass authentication by forging login events for any existing user, including administrators, without a password. The plugin fails to properly validate WeChat webhook requests, causing its signature check to always pass. Additionally, the login code is disclosed in the webhook response, enabling an attacker to read it and redeem it through an unauthenticated AJAX action to gain unauthorized access.

This is classified as an improper authentication vulnerability (CWE-287) and has a critical severity with a CVSS score of 9.8.

Useful 0 Not Useful 0

Detection Guidance

Check if the 'QRcode Login for WeChat' plugin version 1.3 or below is installed. Inspect webhook responses for the plugin to see if they disclose login codes. Monitor for unauthorized login attempts or AJAX actions related to the plugin.

Useful 0 Not Useful 0

Impact Analysis

If you use the vulnerable plugin, an attacker could take over any user account on your WordPress site, including administrator accounts, without needing a password. This could lead to complete site compromise, data theft, unauthorized changes, or malware installation. The attacker only needs to exploit the webhook response to obtain the login code and redeem it.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive user data, violating compliance requirements under GDPR (data protection) and HIPAA (health information privacy). Unauthorized access may result in data breaches, requiring mandatory notifications and potential fines under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Disable or uninstall the 'QRcode Login for WeChat' plugin immediately. Implement strict input validation for webhook requests. Restrict access to sensitive AJAX actions. Review user accounts for unauthorized access.

Useful 0 Not Useful 0