CVE-2020-13485: Knock Knock plugin IP Whitelist bypass via an X-Forwarded-For HTTP header
Summary
CVE-2020-13485: Knock Knock plugin IP Whitelist bypass via an X-Forwarded-For HTTP header. Affects verbb/knock-knock versions < 1.2.8. Fixed in 1.2.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Knock Knock plugin is a component of Craft CMS that provides IP Whitelist functionality. It allows administrators to restrict access to the CMS based on IP addresses. The plugin is commonly used to enhance security by limiting access to authorized users only.
Vulnerability Detail
The Knock Knock plugin before version 1.2.8 is vulnerable to an IP Whitelist bypass. This vulnerability can be exploited by an attacker by sending a specially crafted X-Forwarded-For HTTP header. By manipulating this header, an attacker can bypass the IP Whitelist and gain unauthorized access to the CMS. This can lead to potential security breaches, data leaks, and unauthorized modifications to the CMS.
How To Fix
Minimum fixed version
1.2.8
This is the first release that contains the fix.
composer require verbb/knock-knock:1.2.8Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the plugin to the latest version to mitigate the risk of IP Whitelist bypass.
Conclusion
The Knock Knock plugin before version 1.2.8 for Craft CMS is vulnerable to an IP Whitelist bypass. This can allow attackers to gain unauthorized access to the CMS and potentially compromise its security. It is crucial to update the plugin to version 1.2.8 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for verbb/knock-knock →
FAQ
This vulnerability allows attackers to bypass the IP Whitelist feature of the Knock Knock plugin, potentially gaining unauthorized access to the CMS and compromising its security.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the composer.lock file.
Yes, the CVSS score for this vulnerability is 9.1, indicating a critical severity level.
There are no known public exploits for this vulnerability at the time of writing. However, it is crucial to update the plugin to the latest version to prevent potential exploitation.
For more information about this vulnerability, you can refer to the GitHub Advisory Database at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-wxvr-qqm7-6h65/GHSA-wxvr-qqm7-6h65.json
Related vulnerabilities
Recent vulnerabilities recorded for verbb/knock-knock.
