Entreprise française de cybersécurité depuis 2004
☎ 03 60 47 09 81 - info@securiteinfo.com

CVE-2017-8295

Description

WordPress through 4.7.4 relies on the Host HTTP header for a password-reset e-mail message, which makes it easier for remote attackers to reset arbitrary passwords by making a crafted wp-login.php?action=lostpassword request and then arranging for this message to bounce or be resent, leading to transmission of the reset key to a mailbox on an attacker-controlled SMTP server. This is related to problematic use of the SERVER_NAME variable in wp-includes/pluggable.php in conjunction with the PHP mail function. Exploitation is not achievable in all cases because it requires at least one of the following: (1) the attacker can prevent the victim from receiving any e-mail messages for an extended period of time (such as 5 days), (2) the victim's e-mail system sends an autoresponse containing the original message, or (3) the victim manually composes a reply containing the original message.

POC

Reference

- https://exploitbox.io/vuln/WordPress-Exploit-4-7-Unauth-Password-Reset-0day-CVE-2017-8295.html

- https://wpvulndb.com/vulnerabilities/8807

- https://www.exploit-db.com/exploits/41963/

Github

- https://github.com/0v3rride/Week-7

- https://github.com/20142995/nuclei-templates

- https://github.com/ARPSyndicate/cvemon

- https://github.com/Afetter618/WordPress-PenTest

- https://github.com/Astrogeorgeonethree/Starred

- https://github.com/Astrogeorgeonethree/Starred2

- https://github.com/Atem1988/Starred

- https://github.com/DynamicDesignz/Alien-Framework

- https://github.com/Elias-Junior/Passo-a-passo-Wordpress

- https://github.com/Gshack18/WPS_Scan

- https://github.com/LeCielBleu/SecurityDocs

- https://github.com/SexyBeast233/SecBooks

- https://github.com/ZTK-009/collection-document

- https://github.com/alash3al/wp-allowed-hosts

- https://github.com/alphaSeclab/sec-daily-2019

- https://github.com/beelzebielsk/csc59938-week-7

- https://github.com/cyberheartmi9/CVE-2017-8295

- https://github.com/d-roman-halliday/simple_cd_stripper

- https://github.com/harrystaley/CSCI4349_Week9_Honeypot

- https://github.com/harrystaley/TAMUSA_CSCI4349_Week9_Honeypot

- https://github.com/holisticon/hack-yourself

- https://github.com/homjxi0e/CVE-2017-8295-WordPress-4.7.4---Unauthorized-Password-Reset

- https://github.com/investlab/Reset-wordpress-pass

- https://github.com/lnick2023/nicenice

- https://github.com/password520/collection-document

- https://github.com/qazbnm456/awesome-cve-poc

- https://github.com/umarfarook882/WAF-Rule-Writing-part-3

- https://github.com/wisoez/Reset-wordpress-pass

- https://github.com/xbl3/awesome-cve-poc_qazbnm456