Overview
The Awesome Support – WordPress HelpDesk & Support Plugin is subject to a critical vulnerability that exposes sensitive information to unauthenticated attackers. This vulnerability, designated as CVE-2024-13567, affects all versions of the plugin up to and including 6.3.1. Given the widespread use of WordPress and its associated plugins, this vulnerability potentially puts a significant number of websites and their data at risk.
Vulnerability Summary
CVE ID: CVE-2024-13567
Severity: High (7.5 CVSS)
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: Potential system compromise and data leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
Awesome Support – WordPress HelpDesk & Support Plugin | Up to and including 6.3.1
How the Exploit Works
The vulnerability resides in the ‘awesome-support’ directory, which could store file attachments included in support tickets. An unauthenticated attacker can exploit this vulnerability by making a specific network request to the ‘/wp-content/uploads/awesome-support’ directory, thereby extracting stored data. The extracted data may contain sensitive information, leading to a potential system compromise and data leakage.
Conceptual Example Code
An attacker might exploit the vulnerability using a HTTP GET request like this:
GET /wp-content/uploads/awesome-support HTTP/1.1
Host: vulnerable-website.comThis request would retrieve the contents of the ‘awesome-support’ directory, potentially including sensitive data.
Mitigation
Users of the Awesome Support – WordPress HelpDesk & Support Plugin are advised to update to the latest version of the plugin, which includes a patch for this vulnerability. As a temporary mitigation, users can also use a Web Application Firewall (WAF) or Intrusion Detection System (IDS) to detect and block attempted exploits.
