CVE-2024-8485 Auth bypass in REST API TO MiniProgram
Unauthenticated attackers can update arbitrary user emails to trigger password resets, leading to account takeover and privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-8485?
CVE-2024-8485 is a critical authentication bypass vulnerability in xjb REST API TO MiniProgram, published on 25 Sep 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The REST API TO MiniProgram plugin for WordPress is vulnerable to privilege escalation via account takeovr in all versions up to, and including, 4.7.1 via the updateUserInfo() due to missing validation on the 'openid' user controlled key that determines what user will be updated. This makes it possible for unauthenticated attackers to update arbitrary user's accounts, including their email to a @weixin.com email, which can the be leveraged to reset the password of the user's account, including administrators.
Weakness: CWE-639
Which versions are affected by CVE-2024-8485?
It affects 1 product.
Products include Jianbo Rest Api to Miniprogram.
How do I fix CVE-2024-8485?
No fix has been published for CVE-2024-8485 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2024-8485 being exploited?
There is no known exploitation of CVE-2024-8485 in the wild and no public exploit code.
Other vulnerabilities in xjb REST API TO MiniProgram
Sources
Also known as GHSA-563f-r8fh-rrgc.