I'm working on implementing a protection for a WordPress pie register plugin vulnerability being called:

WordPress pie register auth bypass / RCE

I've conducted a research on the pie register source code (it's an open-source plugin) and on the published metasploit exploit for this vulnerability, and figured out that the vulnerability is in the communication between the pie register WP plugin and the pie register social login addon.

To get a better understanding, I've used burp suite's proxy in order to be able to see the exploit's malicious packets, and as a result found the following malicious HTTP request as the key for bypassing the authentication:

enter image description here

It seems that whenever the pie register plugin receives a request including user_id_social_site=x&social_site=true it blindly accepts the request as a valid social login request, even if the social login addon isn't active (and as a result, the attacker gains access to user_id x).

I've built a HTTP proxy which I'm trying to implement the vulnerability protection on, but unfortunately I'm having a hard time trying to think of an effective protection. Therefore, I will more than appreciate any suggestions!

Link for the vulnerability exploit: https://www.rapid7.com/db/modules/exploit/unix/webapp/wp_pie_register_bypass_rce/

  • This is an application layer attack (TCP payload) whereas the Linux kernel firewall does network layer filtering (TCP meta data). The minimal payload matching possible in the kernel is not sufficient to reliably detect the attack since it is only packet based and can thus bypassed by packetizing the content in a different way. Also, in-kernel will not be able to look into HTTPS connections. It is thus the wrong tool for the job. Commented Feb 9, 2022 at 7:35
  • O wow - question as a moving target. Starting with "Linux kernel firewall" w/o an idea and moving to "HTTP proxy" w/o an idea. Recommend next step for moving the questions - have a look at Web Application Firewalls since these are the right tool for the job, i.e. things like ModSecurity. And please dig deeper into the topic yourself first before giving up of finding a solution yourself. Commented Feb 9, 2022 at 7:40
  • Thanks for your detailed comment @SteffenUllrich! I've edited my question accordingly, and was about to announce that in the comments - sorry for the moving question. If I have a Linux kernel firewall which directs all of the HTTP packets to a HTTP proxy, wouldn't it be possible to implement the protection on the proxy? I've tried to research the social login addon but unfortunately it's a paid addon, and thus I'm not sure how to dig deeper in this context. btw, please forgive me for my lack of knowledge in using the appropriate tool
    – Amit Gabay
    Commented Feb 9, 2022 at 7:45
  • The common way to tackle such problem is to have a filtering Reverse Proxy in front of the application. There is no kernel support needed for this - the Reverse Proxy is the server accessible from outside which then will forward the filtered traffic to the protected web application not accessible from outside. This kind of approach is called a Web Application Firewall (WAF) and apart from many commercial implementation there are free ones too, like using ModSecurity as a module with Apache or nginx. These WAF have powerful pattern matching to do what you need. Commented Feb 9, 2022 at 7:49


You must log in to answer this question.