CVE-2020-13485
📋 TL;DR
The Knock Knock plugin for Craft CMS before version 1.2.8 allows attackers to bypass IP whitelist restrictions by manipulating the X-Forwarded-For HTTP header. This vulnerability affects any Craft CMS installation using the vulnerable plugin version. Attackers can gain unauthorized access to protected admin areas.
💻 Affected Systems
- Knock Knock plugin for Craft CMS
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the Craft CMS admin interface, allowing attackers to modify content, install malicious plugins, or take over the entire website.
Likely Case
Unauthorized access to admin areas, potentially leading to content manipulation, data exposure, or privilege escalation.
If Mitigated
Limited impact if proper network segmentation, additional authentication layers, or WAF rules are in place to validate X-Forwarded-For headers.
🎯 Exploit Status
Exploitation requires sending HTTP requests with manipulated X-Forwarded-For headers to bypass IP-based access controls.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.2.8
Vendor Advisory: https://github.com/verbb/knock-knock/blob/craft-3/CHANGELOG.md
Restart Required: No
Instructions:
1. Update Knock Knock plugin to version 1.2.8 or later via Craft CMS admin panel or Composer. 2. Verify the update completed successfully. 3. Test IP whitelist functionality.
🔧 Temporary Workarounds
WAF Rule for X-Forwarded-For Validation
allConfigure web application firewall to validate and sanitize X-Forwarded-For headers
Disable Knock Knock Plugin
allTemporarily disable the plugin if immediate patching isn't possible
🧯 If You Can't Patch
- Implement additional authentication factor for admin access
- Restrict admin access to specific IP ranges at network/firewall level
🔍 How to Verify
Check if Vulnerable:
Check Craft CMS admin panel for Knock Knock plugin version. If version is below 1.2.8 and IP whitelisting is enabled, the system is vulnerable.Check Version:
Check Craft CMS admin panel → Plugins → Knock KnockVerify Fix Applied:
Confirm plugin version is 1.2.8 or higher in Craft CMS admin panel and test IP whitelist functionality with various X-Forwarded-For header values.📡 Detection & Monitoring
Log Indicators:
- Multiple failed login attempts with varying X-Forwarded-For headers
- Successful admin access from unexpected IP addresses
Network Indicators:
- HTTP requests with manipulated X-Forwarded-For headers to admin endpoints
- Unusual traffic patterns to /admin paths
SIEM Query:
sourceIP NOT IN whitelist AND destinationPort=80 AND httpHeader contains 'X-Forwarded-For' AND uri contains '/admin'