CVE-2017-8295
MEDIUM EXPLOITEDWordPress <= 4.7.4 - Unauthenticated Weak Password Recovery Mechanism via Host Header Manipulation
Title source: llmExploitation Summary
CVE-2017-8295 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 6 public exploits from researchers including Dawid Golunski, cyberheartmi9, alash3al.
AI-analyzed exploit summary This exploit demonstrates a password reset vulnerability in WordPress 4.7 by manipulating the Host header to redirect password reset emails to an attacker-controlled domain. It leverages improper handling of the SERVER_NAME variable to spoof email headers.
Description
WordPress through 4.7.4 relies on the Host HTTP header for a password-reset e-mail message, which makes it easier for remote attackers to reset arbitrary passwords by making a crafted wp-login.php?action=lostpassword request and then arranging for this message to bounce or be resent, leading to transmission of the reset key to a mailbox on an attacker-controlled SMTP server. This is related to problematic use of the SERVER_NAME variable in wp-includes/pluggable.php in conjunction with the PHP mail function. Exploitation is not achievable in all cases because it requires at least one of the following: (1) the attacker can prevent the victim from receiving any e-mail messages for an extended period of time (such as 5 days), (2) the victim's e-mail system sends an autoresponse containing the original message, or (3) the victim manually composes a reply containing the original message.
Exploits (6)
This exploit demonstrates a password reset vulnerability in WordPress 4.7 by manipulating the Host header to redirect password reset emails to an attacker-controlled domain. It leverages improper handling of the SERVER_NAME variable to spoof email headers.
This PoC exploits CVE-2017-8295, a WordPress password reset vulnerability where the Host header is used to manipulate the password reset email destination. The script sends crafted requests to multiple WordPress sites to trigger password reset emails to an attacker-controlled domain.
This repository provides a WordPress plugin designed to mitigate the CVE-2017-8295 vulnerability by restricting allowed hostnames. It includes installation and usage instructions but does not contain exploit code.
This repository contains a functional Perl exploit for CVE-2017-8295, which targets WordPress versions prior to 4.7.4. The exploit manipulates the Host HTTP header to redirect password reset emails to an attacker-controlled domain, allowing unauthorized password resets.
This repository contains a functional Perl exploit for CVE-2017-8295, which leverages the Host HTTP header to manipulate WordPress password reset emails. The exploit sends a crafted request to trigger a password reset email to an attacker-controlled domain.
This repository contains a writeup describing CVE-2017-8295, an unauthorized password reset vulnerability in WordPress 4.7.4. The vulnerability allows attackers to obtain password reset links without authentication, potentially leading to account compromise.
References (6)
Scores
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N