Exploit for Authentication Bypass Using an Alternate Path or Channel in Really-Simple-Plugins Really Simple Security CVE-2024-10924

## https://sploitus.com/exploit?id=B7A42183-C355-53B8-9F95-93122709E7B5
# WordPress CVE-2024-10924 Exploit

📌 Overview

This repository contains a Proof-of-Concept (PoC) exploit for CVE-2024-10924, a vulnerability in the Really Simple SSL WordPress plugin that allows bypassing two-factor authentication (2FA). Attackers can exploit this flaw to log in as any user with a valid ID.

🚨 WARNING: This exploit is for educational and research purposes only. Unauthorized use against systems you do not own is illegal.


🚀 Exploit Usage

Prerequisites:
 - Python 3.x installed
 - Target WordPress site using the vulnerable version of "Really Simple SSL"

Installation:
  Clone the repository: |
    $ git clone https://github.com/h8sU/wordpress-cve-2024-10924-exploit.git
    $ cd wordpress-cve-2024-10924-exploit

Run the Exploit:
    $ python exploit.py <target_url> <user_id>

Example:
    $ python exploit.py http://web.com 1
    
This sends a crafted request to bypass 2FA authentication for the specified user_id.


🛡️ Mitigation & Fixes

How to Secure Your WordPress Site:
  - Update the Plugin - Ensure that "Really Simple SSL" is updated to the latest version where the vulnerability is patched.
  - Restrict REST API Access - Use security plugins like Wordfence to limit unauthorized API access.
  - Validate Nonces Properly - Ensure nonces are required and validated server-side before executing critical actions.
  - Use Strong Authentication Mechanisms - Implement additional security layers like Web Application Firewalls (WAF).
  - Monitor Access Logs - Check your logs for suspicious API requests to rest_route=/reallysimplessl/v1/two_fa/skip_onboarding.
  - Apply Code Fix - Ensure that the skip_onboarding function properly checks user authentication and nonce validation. The following code snippet demonstrates a recommended fix:

      try {
        $this->check_login_and_get_user($parameters->user_id, $parameters->login_nonce);
      } catch (Exception $e) {
        return new WP_REST_Response(['error' => $e->getMessage()], 403);
      }

    By implementing this fix, unauthorized requests will be denied with a 403 Forbidden response.

⚠️ Disclaimer

This project is intended for educational and security research purposes only. Any unauthorized attempt to exploit live systems without permission is illegal and could lead to severe legal consequences. Use responsibly.