kk Star Ratings < 5.4.6 - Rating Tampering via Race Condition

vendor:

kk Star Ratings

by:

Mohammad Reza Omrani

4.1

CVSS

MEDIUM

Rating Tampering

362

CWE

Product Name: kk Star Ratings

Affected Version From: 5.4.2005

Affected Version To: 5.4.2006

Patch Exists: YES

Related CWE: CVE-2023-4642

CPE: a:kk-star-ratings_project:kk-star-ratings:5.4.5

Metasploit:

Other Scripts:

Platforms Tested: Wordpress

2023

kk Star Ratings < 5.4.6 - Rating Tampering via Race Condition

The kk Star Ratings plugin before version 5.4.6 for WordPress allows attackers to tamper with ratings via a race condition. By intercepting the rating submission request using tools like Burp and Turbo Intruder, an attacker can manipulate the connection header and send multiple requests simultaneously to alter the total rates displayed on the page.

Mitigation:

Update to version 5.4.6 or later of the kk Star Ratings plugin to prevent this vulnerability. Additionally, monitor and rate limit requests to the rating submission endpoint to detect and mitigate potential tampering.

Source

Exploit-DB raw data:

# Exploit Title: kk Star Ratings < 5.4.6 - Rating Tampering via Race
Condition
# Google Dork: inurl:/wp-content/plugins/kk-star-ratings/
# Date: 2023-11-06
# Exploit Author: Mohammad Reza Omrani
# Vendor Homepage: https://github.com/kamalkhan
# Software Link: https://wordpress.org/plugins/kk-star-ratings/
# WPScan :
https://wpscan.com/vulnerability/6f481d34-6feb-4af2-914c-1f3288f69207/
# Version: 5.4.6
# Tested on: Wordpress 6.2.2
# CVE : CVE-2023-4642

# POC:
1- Install and activate kk Star Ratings.
2- Go to the page that displays the star rating.
3- Using Burp and the Turbo Intruder extension, intercept the rating
submission.
4- Send the request to Turbo Intruder using Action > Extensions > Turbo
Intruder > Send to turbo intruder.
5- Drop the initial request and turn Intercept off.
6- In the Turbo Intruder window, add "%s" to the end of the connection
header (e.g. "Connection: close %s").
7- Use the code `examples/race.py`.
8- Click "Attack" at the bottom of the window. This will send multiple
requests to the server at the same moment.
9- To see the updated total rates, reload the page you tested.