Attacker Value
Very High
(1 user assessed)
Exploitability
Very High
(1 user assessed)
User Interaction
None
Privileges Required
None
Attack Vector
Network
2

CVE-2020-35234

Disclosure Date: December 14, 2020
Exploited in the Wild
Reported by h00die
Add MITRE ATT&CK tactics and techniques that apply to this CVE.

Description

The easy-wp-smtp plugin before 1.4.4 for WordPress allows Administrator account takeover, as exploited in the wild in December 2020. If an attacker can list the wp-content/plugins/easy-wp-smtp/ directory, then they can discover a log file (such as #############_debug_log.txt) that contains all password-reset links. The attacker can request a reset of the Administrator password and then use a link found there.

Add Assessment

2
Ratings
  • Attacker Value
    Very High
  • Exploitability
    Very High
Technical Analysis

This is a rather neat vulnerability IMO.

Easy WP SMTP versions <= 1.4.2 has a non-default debug option. When set, the WordPress plugin creates a [a-z0-9]{5,15}_debug_log.txt file in the wp-content/plugins/easy-wp-smtp/ directory. Problem is, this folder allows directory listings, so the file can easily be accessed. The debug log file contains SMTP logs for the Wordpress instance.

Attack chain is as follows:

  1. find the debug_log file
  2. request a password reset for an account
  3. read the debug_log file which will have the password reset link for that user
  4. use the link to change the password for that user.

Pretty easy to exploit, but but not necessarily in an automated way since the password change may have unknown requirements. Easy to do manually though!

The file may also contain creds for the SMTP server!

https://github.com/rapid7/metasploit-framework/pull/14474

CVSS V3 Severity and Metrics
Base Score:
7.5 High
Impact Score:
3.6
Exploitability Score:
3.9
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector (AV):
Network
Attack Complexity (AC):
Low
Privileges Required (PR):
None
User Interaction (UI):
None
Scope (S):
Unchanged
Confidentiality (C):
High
Integrity (I):
None
Availability (A):
None

General Information

Additional Info

Technical Analysis