Very High
CVE-2020-35234
CVE-2020-35234
Description
The easy-wp-smtp plugin before 1.4.4 for WordPress allows Administrator account takeover, as exploited in the wild in December 2020. If an attacker can list the wp-content/plugins/easy-wp-smtp/ directory, then they can discover a log file (such as #############_debug_log.txt) that contains all password-reset links. The attacker can request a reset of the Administrator password and then use a link found there.
Add Assessment
Technical Analysis
This is a rather neat vulnerability IMO.
Easy WP SMTP versions <= 1.4.2 has a non-default debug option. When set, the WordPress plugin creates a [a-z0-9]{5,15}_debug_log.txt file in the wp-content/plugins/easy-wp-smtp/ directory. Problem is, this folder allows directory listings, so the file can easily be accessed. The debug log file contains SMTP logs for the Wordpress instance.
Attack chain is as follows:
- find the debug_log file
- request a password reset for an account
- read the debug_log file which will have the password reset link for that user
- use the link to change the password for that user.
Pretty easy to exploit, but but not necessarily in an automated way since the password change may have unknown requirements. Easy to do manually though!
The file may also contain creds for the SMTP server!
CVSS V3 Severity and Metrics
General Information
Vendors
- wp-ecommerce
Products
- easy wp smtp
Metasploit Modules
