CVE-2021-25094 Tatsu < 3.3.12 - Unauthenticated RCE

2022-04-2515:50:46

CWE-306

WPScan

www.cve.org

8.5 High

AI Score

Confidence

High

0.122 Low

EPSS

Percentile

95.4%

JSON

The Tatsu WordPress plugin before 3.3.12 add_custom_font action can be used without prior authentication to upload a rogue zip file which is uncompressed under the WordPress’s upload directory. By adding a PHP shell with a filename starting with a dot “.”, this can bypass extension control implemented in the plugin. Moreover, there is a race condition in the zip extraction process which makes the shell file live long enough on the filesystem to be callable by an attacker.

CNA Affected

[
  {
    "product": "Tatsu",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "3.3.12",
        "status": "affected",
        "version": "3.3.12",
        "versionType": "custom"
      }
    ]
  }
]