Authentication Bypass in Really Simple Security WordPress Plugin

Repository contains an operational Python exploit (CVE-2024-10924.py) targeting the Really Simple Security/Really Simple SSL WordPress plugin. The exploit performs a pre-auth REST request to /?rest_route=/reallysimplessl/v1/two_fa/skip_onboarding with user_id=1 and a crafted login_nonce to trigger an authentication/2FA bypass and harvest WordPress auth cookies from Set-Cookie headers. Using these cookies, it requests /wp-admin/plugin-install.php to scrape the _wpnonce value, then uploads an attacker-supplied plugin ZIP to /wp-admin/update.php?action=upload-plugin. After upload, it assumes the plugin deploys a webshell at /wp-content/plugins/rce-plugin/cmd.php, verifies accessibility, attempts OS detection by reading the response body, and provides an interactive shell that executes arbitrary commands via GET parameter cmd. Repo structure: (1) CVE-2024-10924.py is the main entry point and contains all exploitation logic (requests.Session handling, cookie parsing, nonce scraping via BeautifulSoup, plugin upload multipart form, and interactive command loop). (2) README.md documents usage and describes the auth bypass to RCE chain. (3) A large plugin/9.1.1.1/.svn/ directory appears to be a vendor snapshot of the vulnerable plugin source (PHP/JS/CSS) including the REST route registration with permission_callback=__return_true for skip_onboarding, which provides context for the vulnerability; it is not required to run the exploit. No Metasploit/Nuclei framework integration is present.

This repository demonstrates and mitigates CVE-2024-10924, an authentication bypass vulnerability in the 'Really Simple Security' WordPress plugin. The structure includes Docker and docker-compose files to set up a vulnerable WordPress environment, a Python exploit script (exploit.py) that automates the attack, and PHP scripts for enabling 2FA and mitigation. The exploit targets the REST API endpoint '/reallysimplessl/v1/two_fa/skip_onboarding' by sending a crafted POST request, resulting in admin session cookies being returned without valid credentials. The repository also provides a mitigation script (mitigation.php) and a PowerShell patching script (patch.ps1) to block the vulnerable endpoint. The exploit is a working proof-of-concept, requiring the vulnerable plugin version and specific environment setup. No fake or destructive code is present; the repository is focused on demonstrating the vulnerability and its remediation.

This repository contains a proof-of-concept exploit for CVE-2024-10924, a critical 2FA bypass vulnerability in the Really Simple SSL plugin for WordPress. The repository consists of a detailed penetration testing report (README.md) and a Python exploit script (exploit.py). The exploit targets a WordPress 6.8.1 installation with the vulnerable plugin enabled. The Python script sends a crafted POST request to the REST API endpoint '/?rest_route=/reallysimplessl/v1/two_fa/skip_onboarding' with a user-supplied user ID and an arbitrary nonce, exploiting the authentication logic flaw to bypass 2FA. If successful, the script extracts and displays authentication cookies from the response, which can be used to gain administrative access to the WordPress dashboard. The README provides comprehensive context, including the target domain (https://skior.co), server details, methodology, and raw HTTP requests used during exploitation. The exploit is a standalone POC and does not belong to any framework.

This repository contains a single Python script exploiting CVE-2024-10924, a vulnerability in the 'Really Simple SSL' WordPress plugin. The script takes a target site URL and a user ID as arguments, then sends a crafted POST request to the '/?rest_route=/reallysimplessl/v1/two_fa/skip_onboarding' REST API endpoint. It attempts to bypass two-factor authentication onboarding for the specified user by providing an invalid nonce and a redirect path. If the request is successful, the script prints out any cookies set by the server, which may include authentication/session cookies. The exploit demonstrates a proof-of-concept attack and requires the attacker to know a valid user ID on the target WordPress site. The repository is structured as a single file with no additional modules or documentation.

This repository provides a proof-of-concept (PoC) exploit for CVE-2024-10924, an authentication bypass vulnerability in the Really Simple SSL WordPress plugin (versions 9.0.0 to 9.1.1.1). The exploit is implemented in C (exploit/10924Sblsec.c) and uses libcurl to send a crafted JSON POST request to the vulnerable REST API endpoint ('/reallysimplessl/v1/two_fa/skip_onboarding'). By specifying a valid user ID and a target URL, the exploit attempts to bypass two-factor authentication and retrieve session cookies for the targeted user. If successful, these cookies can be injected into a browser to gain unauthorized access to the WordPress admin panel as that user. The repository includes a README with vulnerability details and a USAGE.md file with compilation and usage instructions. No hardcoded endpoints are present; the user supplies the target URL and user ID at runtime.

This repository contains a proof-of-concept exploit (Exploit.py) and a detailed README for CVE-2024-10924, a critical authentication bypass vulnerability in the WordPress Really Simple Security plugin. The exploit is a Python script that takes a user_id as input and sends a crafted POST request to the vulnerable REST API endpoint, attempting to bypass authentication and retrieve session cookies. If successful, these cookies could be used to gain administrative access to the WordPress site. The README provides background on the vulnerability, its impact, and mitigation steps. The repository is structured simply, with one exploit script and one documentation file, and is intended to demonstrate the vulnerability rather than provide a weaponized attack.

This repository contains a working exploit for CVE-2024-10924, targeting the Really Simple SSL plugin for WordPress. The exploit consists of a single Python script (exploit.py) and a README.md with detailed usage instructions. The script sends a crafted POST request to the vulnerable REST API endpoint /reallysimplessl/v1/two_fa/skip_onboarding, specifying a user ID and an arbitrary nonce. If the target is vulnerable, the server responds with authentication cookies for the specified user (typically an admin). These cookies can then be manually injected into a browser to gain unauthorized admin access to the WordPress site. The exploit requires knowledge of a valid user ID and the target domain. The repository is straightforward, with clear instructions and a single operational exploit script.

This repository provides a Python proof-of-concept exploit for CVE-2024-10924, a vulnerability in the 'Really Simple SSL' WordPress plugin that allows attackers to bypass two-factor authentication (2FA) for any user with a known user ID. The exploit consists of a single Python script ('exploit.py') and a detailed README. The script takes a target WordPress site URL and a user ID as arguments, then sends a crafted POST request to the plugin's vulnerable REST API endpoint ('/?rest_route=/reallysimplessl/v1/two_fa/skip_onboarding'). If successful, the exploit may return authentication cookies, allowing the attacker to access the user's account. The README provides usage instructions, mitigation advice, and a code snippet for patching the vulnerability. The exploit is network-based and targets WordPress installations with the affected plugin version.

This repository contains a proof-of-concept exploit for CVE-2024-10924, a critical authentication bypass vulnerability in the Really Simple Security WordPress plugin (versions 9.0.0 to 9.1.1.1). The exploit consists of a single Python script (exploit.py) and a detailed README. The script takes a target URL and user ID as arguments, then sends a crafted POST request to the vulnerable REST API endpoint '/?rest_route=/reallysimplessl/v1/two_fa/skip_onboarding'. If successful, it retrieves and displays authentication cookies for the specified user, potentially granting admin access. The exploit demonstrates the vulnerability but does not weaponize it beyond cookie extraction. The README provides context, usage instructions, and a cURL example. No hardcoded IPs or domains are present; the target is user-supplied. The repository is a clear, focused POC for security testing and research.

This repository contains a Python exploit script (CVE-2024-10924.py) and a README.md. The exploit targets the 'Really Simple Security' WordPress plugin (versions 9.0.0 to 9.1.1.1), specifically exploiting an authentication bypass vulnerability in the Two-Factor Authentication API. The script first checks the plugin version by fetching the readme.txt file from the target site. If the site is vulnerable, it sends a crafted POST request to the '/wp-json/reallysimplessl/v1/two_fa/skip_onboarding' endpoint to bypass authentication and obtain valid session cookies for the admin user. The script then uses Selenium to launch a Chrome browser, injects the obtained cookies, and accesses the '/wp-admin/' dashboard as an administrator. The repository is well-structured, with clear usage instructions and a detailed README explaining the vulnerability, exploitation steps, and requirements. No hardcoded IPs or domains are present; all endpoints are relative to the user-supplied target URL.

This repository provides a practical exploit lab for CVE-2024-10924, a vulnerability in WordPress that allows bypassing two-factor authentication (MFA) to gain admin access. The structure includes three main Python scripts: 1. 'bypass-MFA-Wordpress.py' is the core exploit, automating the attack by sending a crafted POST request to the '/reallysimplessl/v1/two_fa/skip_onboarding' REST endpoint to obtain a session cookie, then logging in as admin via '/wp-admin/profile.php'. If successful, it saves the admin dashboard HTML locally and opens it in the browser. 2. 'endpointWordpress.py' is a helper script that prints out the exact HTTP request needed to exploit the vulnerability, useful for manual exploitation or use with tools like Burp Suite. 3. 'knowIPwordpress.py' is a reconnaissance script that scans the local network for the vulnerable WordPress instance by looking for an HTTP service with the title 'Bypass-MFA', then outputs the admin panel URL. The repository also includes a README with detailed instructions and a VMware image for setting up a vulnerable lab environment. The exploit is operational, requiring the attacker to know the target's IP and have network access. The main attack vector is network-based, targeting the WordPress REST API endpoint. The exploit is not part of a framework and is implemented in Python.

This repository contains a proof-of-concept (PoC) exploit for CVE-2024-10924, targeting the 'Really Simple Security' WordPress plugin's MFA implementation. The exploit is implemented in a single Python script (poc.py) and is accompanied by a README.md with usage instructions and context. The script works by first sending a crafted POST request to the vulnerable REST API endpoint '/?rest_route=/reallysimplessl/v1/two_fa/skip_onboarding' to obtain a valid authentication cookie. It then uses this cookie to perform a login and access the admin profile page ('/wp-admin/profile.php'), saving the response as an HTML file and opening it in the user's browser. The exploit requires the attacker to know valid WordPress credentials and the target URL. The repository is structured simply, with the main exploit logic in poc.py and documentation in README.md. No fake or destructive code is present; the exploit is a functional PoC for authentication bypass via network requests.

This repository provides a Docker-based environment to demonstrate and test CVE-2024-10924, an authentication bypass vulnerability in the 'Really Simple Security' WordPress plugin (versions 9.0.0 to 9.1.1.1). The repository includes a Dockerfile, docker-compose.yml, and setup scripts to automatically deploy WordPress with the vulnerable plugin and a MySQL backend. The exploit is not a standalone script but rather an environment that allows researchers to manually test the authentication bypass by interacting with the WordPress REST API when the 'Two-Factor Authentication' feature is enabled. The main attack vector is network-based, targeting the REST API endpoints exposed by the WordPress instance. The environment is suitable for both research and demonstration of the vulnerability, but does not include weaponized or automated exploitation code.

This repository contains a Python3 exploit (exploit.py) targeting the 'Really Simple Security' WordPress plugin versions 9.0.0 through 9.1.1.1, exploiting CVE-2024-10924. The exploit leverages an authentication bypass vulnerability in the plugin's REST API endpoint '/?rest_route=/reallysimplessl/v1/two_fa/skip_onboarding' when the 'Two-Factor Authentication' feature is enabled. The script allows an unauthenticated attacker to impersonate any user (including admin) by sending a crafted POST request with a chosen user ID, a random login_nonce, and a redirect path. If successful, the attacker receives a valid session cookie, effectively logging in as the victim user. The repository includes the main exploit script, a requirements.txt for dependencies (requests, validators), and documentation in README.md. The exploit is a proof-of-concept and does not include weaponized or post-exploitation features.