CVE-2021-24148 : Security Advisory and Response

A business logic issue in the MStore API WordPress plugin, versions before 3.2.0, allowed an authentication bypass with Sign In With Apple, enabling unauthenticated users to obtain an authentication cookie using only an email address.

Understanding CVE-2021-24148

This CVE identifies an authentication bypass vulnerability in the MStore API plugin for WordPress.

What is CVE-2021-24148?

The CVE-2021-24148 describes a vulnerability in the MStore API plugin for WordPress that existed in versions earlier than 3.2.0. It allowed unauthenticated users to bypass authentication by using Sign In With Apple feature.

The Impact of CVE-2021-24148

The impact of this vulnerability is severe as it could lead to unauthorized access to user accounts and sensitive information through an authentication cookie obtained via an email address.

Technical Details of CVE-2021-24148

This section will provide a more in-depth look at the vulnerability.

Vulnerability Description

The vulnerability in the MStore API plugin versions less than 3.2.0 allowed for an authentication bypass using Sign In With Apple, enabling unauthenticated users to retrieve an authentication cookie with just an email address.

Affected Systems and Versions

The affected system is the MStore API WordPress plugin with versions prior to 3.2.0.

Exploitation Mechanism

The exploitation involved abusing the Sign In With Apple functionality to bypass authentication and access authentication cookies through an email address.

Mitigation and Prevention

To prevent exploitation of this vulnerability, immediate steps need to be taken.

Immediate Steps to Take

Users should update the MStore API plugin to version 3.2.0 or newer to mitigate this vulnerability.

Long-Term Security Practices

Implementing strong authentication mechanisms and regular security audits can enhance the overall security posture of WordPress plugins.

Patching and Updates

Regularly updating and patching the MStore API plugin to the latest version is crucial to avoid known vulnerabilities and ensure system security.