Wordfence Argus Finds Critical Authentication Bypass in WPMU DEV Dashboard Plugin

The vulnerability in the WPMU DEV Dashboard plugin, affecting versions up to and including 5.0.1, is an unauthenticated authentication bypass that can be exploited by an attacker to gain unauthorized access to a WordPress site through Single Sign-On (SSO) functionality integrated with the WPMU DEV Hub.

Vulnerability Details

Overview

The vulnerability lies in the SSO process where an attacker can bypass authentication checks and obtain a valid session for a mapped user, typically an administrator. This is achieved by manipulating the state value used in the SSO flow to forge requests that pass validation without proper authorization.

Exploitation Steps

1. Step 1: Forge State Value

   • The attacker crafts a request with a forged state parameter and obtains a response containing a token.

2. Step 2: Replay Attack

   • The attacker replays the crafted state value in a subsequent request to bypass authentication checks, leading to unauthorized access.

Code Analysis

The critical flaw is in how the plugin handles the HMAC validation of the state parameter:

• The plugin stores and returns the active token, allowing an attacker to submit a fresh token.
• It relies on a cookie (`wdp-pre

Read the full article at Wordfence

---

Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.