Autoptimize < 2.7.8 - Arbitrary File Upload via "Import Settings"
| Reporter | Title | Published | Views | Family All 29 |
|---|---|---|---|---|
 | CVE-2021-24376 | 21 Jun 202120:15 | – | attackerkb |
 | The vulnerability of the Import Settings function in the Autoptimize plugin allows a hacker to execute arbitrary code. | 25 Jun 202100:00 | – | bdu_fstec |
 | CVE-2020-24948 | 22 Jun 202100:15 | – | circl |
 | WordPress 代码问题漏洞 | 21 Jun 202100:00 | – | cnnvd |
 | CVE-2020-24948 | 3 Sep 202014:06 | – | cve |
| CVE-2021-24376 | 21 Jun 202119:18 | – | cve |
 | CVE-2020-24948 | 3 Sep 202014:06 | – | cvelist |
| CVE-2021-24376 Autoptimize < 2.7.8 - Arbitrary File Upload via "Import Settings" | 21 Jun 202119:18 | – | cvelist |
 | WordPress Plugin Autoptimize 2.7.6 - Authenticated Arbitrary File Upload (Metasploit) | 8 Jan 202100:00 | – | exploitdb |
 | CVE-2020-24948 | 3 Sep 202015:15 | – | nvd |
10
Regularly, zip which contained a PHP file was extracted, but the PHP extension was not on a white list so it was removed from the disk afterwards. It turned out that it is possible to upload a zip which contained a directory with PHP file in it and then it was not removed from the disk.
Upload can be done using Import Settings functionality available in the following directory: http://localhost:8000/wp-content/uploads/ao_ccss/dir/wp-admin/options-general.php?page=ao_critcss
Example content of an archive:
$ zip -sf rce.zip
Archive contains:
dir/
dir/index.php
settings.json
Total 3 entries (20 bytes)
Example content of dir/index.php file:
<?php phpinfo() ?>
settings.json is an empty file.
As you can see, there is a "dir" directory inside a zip which contains index.php file. Both will not be removed from the disk after being extracted. After the upload, file can be accessed by visiting such address: http://localhost:8000/wp-content/uploads/ao_ccss/dir/
Due to the fact that file is named index.php, there was no need to include file name in the address.Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
07 Jun 2021 05:59Current
0.9Low risk
Vulners AI Score0.9
EPSS0.13139