Really Simple SSL

Really Simple SSL exposed a two-factor reset path on the user profile form that only checked a nonce, not whether the user was permitted to turn their second factor off. A user who was required to use two-factor authentication could submit a crafted profile update that deleted their own 2FA metadata, resetting the mandatory-2FA grace period and deferring enforcement indefinitely. The fix removes the permissive reset path and refuses to delete 2FA metadata for any user the site forces to use two-factor authentication.

This vulnerability affects the following application versions:

• Really Simple SSL 9.0.0
• Really Simple SSL 9.0.2
• Really Simple SSL 9.1.0
• Really Simple SSL 9.1.1
• Really Simple SSL 9.1.1.1
• Really Simple SSL 9.1.2
• Really Simple SSL 9.1.3
• Really Simple SSL 9.1.4
• Really Simple SSL 9.2.0
• Really Simple SSL 9.3.1
• Really Simple SSL 9.3.2
• Really Simple SSL 9.3.2.1
• Really Simple SSL 9.3.3
• Really Simple SSL 9.3.5
• Really Simple SSL 9.4.0
• Really Simple SSL 9.4.1
• Really Simple SSL 9.4.2
• Really Simple SSL 9.4.3
• Really Simple SSL 9.5.0
• Really Simple SSL 9.5.0.1
• Really Simple SSL 9.5.0.2
• Really Simple SSL 9.5.1
• Really Simple SSL 9.5.2
• Really Simple SSL 9.5.2.2
• Really Simple SSL 9.5.2.3
• Really Simple SSL 9.5.3
• Really Simple SSL 9.5.3.1
• Really Simple SSL 9.5.3.2
• Really Simple SSL 9.5.4
• Really Simple SSL 9.5.5
• Really Simple SSL 9.5.6
• Really Simple SSL 9.5.7
• Really Simple SSL 9.5.8
• Really Simple SSL 9.5.9
• Really Simple SSL 9.5.10
• Really Simple SSL 9.5.10.1
• Really Simple SSL 9.6.0
• Really Simple SSL 9.6.1
• Really Simple SSL 9.7.0
• Really Simple SSL 9.8.0
• Really Simple SSL 9.8.1

The two-factor profile settings handler in Really Simple SSL applies 2FA profile changes to the WP_User passed via the request without verifying that it matches the currently authenticated user. An authenticated user could therefore modify another user’s two-factor authentication settings (disable 2FA, reset backup codes, change the configured method), which can be used as a stepping stone for account takeover.

This vulnerability affects the following application versions:

• Really Simple SSL 9.0.0
• Really Simple SSL 9.0.2
• Really Simple SSL 9.1.0
• Really Simple SSL 9.1.1
• Really Simple SSL 9.1.1.1
• Really Simple SSL 9.1.2

Missing or incorrect nonce validation on a function makes it possible for unauthenticated attackers to perform an unauthorized action via a forged request granted they can trick a site administrator into performing an action such as clicking on a link

This vulnerability affects the following application versions:

• Really Simple SSL 7.2.2
• Really Simple SSL 7.2.3
• Really Simple SSL 8.0.0
• Really Simple SSL 8.1.0
• Really Simple SSL 8.1.1
• Really Simple SSL 8.1.2
• Really Simple SSL 8.1.3
• Really Simple SSL 8.1.4
• Really Simple SSL 8.1.5
• Really Simple SSL 8.1.6
• Really Simple SSL 8.3.0.1
• Really Simple SSL 9.0.0
• Really Simple SSL 9.0.2
• Really Simple SSL 9.1.0
• Really Simple SSL 9.1.1
• Really Simple SSL 9.1.1.1
• Really Simple SSL 9.1.2
• Really Simple SSL 9.1.3
• Really Simple SSL 9.1.4

This is due to improper user check error handling in the two-factor REST API actions with the ‘check_login_and_get_user’ function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, when the “Two-Factor Authentication” setting is enabled (disabled by default).

CVE ID: CVE-2024-10924

This vulnerability affects the following application versions:

• Really Simple SSL 9.0.0
• Really Simple SSL 9.0.2
• Really Simple SSL 9.1.0
• Really Simple SSL 9.1.1
• Really Simple SSL 9.1.1.1