CVE-2021-24171 - Vulnerability Details - OpenCVE

The WooCommerce Upload Files WordPress plugin before 59.4 ran a single sanitization pass to remove blocked extensions such as .php. It was possible to bypass this and upload a file with a PHP extension by embedding a "blocked" extension within another "blocked" extension in the "wcuf_file_name" parameter. It was also possible to perform a double extension attack and upload files to a different location via path traversal using the "wcuf_current_upload_session_id" parameter.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Vanquish	Woocommerce Upload Files

Configuration 1 [-]

cpe:2.3:a:vanquish:woocommerce_upload_files:*:*:*:*:*:wordpress:*:*

No data.

References

Link	Providers
https://wpscan.com/vulnerability/ed4288a1-f7e4-455f-b765-5ac343f87194
https://www.wordfence.com/blog/2021/03/critical-vulnerability-patched-in-woocommerce-upload-files/

History

Mon, 25 Nov 2024 18:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Vanquish Vanquish woocommerce Upload Files
CPEs	cpe:2.3:a:woocommerce:upload_files::::::wordpress::*	cpe:2.3:a:vanquish:woocommerce_upload_files::::::wordpress::*
Vendors & Products	Woocommerce Woocommerce upload Files	Vanquish Vanquish woocommerce Upload Files

MITRE

Status: PUBLISHED

Assigner: WPScan

Published: 2021-04-05T18:27:44

Updated: 2024-08-03T19:21:18.699Z

Reserved: 2021-01-14T00:00:00

Link: CVE-2021-24171

Vulnrichment

No data.

NVD

Status : Modified

Published: 2021-04-05T19:15:15.857

Modified: 2024-11-25T18:14:49.230

Link: CVE-2021-24171

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "WooCommerce Upload Files", "vendor": "Unknown", "versions": [{"lessThan": "59.4", "status": "affected", "version": "59.4", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "Ramuel Gall"}], "descriptions": [{"lang": "en", "value": "The WooCommerce Upload Files WordPress plugin before 59.4 ran a single sanitization pass to remove blocked extensions such as .php. It was possible to bypass this and upload a file with a PHP extension by embedding a \"blocked\" extension within another \"blocked\" extension in the \"wcuf_file_name\" parameter. It was also possible to perform a double extension attack and upload files to a different location via path traversal using the \"wcuf_current_upload_session_id\" parameter."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-434", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-04-05T18:27:44", "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://wpscan.com/vulnerability/ed4288a1-f7e4-455f-b765-5ac343f87194"}, {"tags": ["x_refsource_MISC"], "url": "https://www.wordfence.com/blog/2021/03/critical-vulnerability-patched-in-woocommerce-upload-files/"}], "source": {"discovery": "UNKNOWN"}, "title": "WooCommerce Upload Files < 59.4 - Unauthenticated Arbitrary File Upload", "x_generator": "WPScan CVE Generator", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "contact@wpscan.com", "ID": "CVE-2021-24171", "STATE": "PUBLIC", "TITLE": "WooCommerce Upload Files < 59.4 - Unauthenticated Arbitrary File Upload"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "WooCommerce Upload Files", "version": {"version_data": [{"version_affected": "<", "version_name": "59.4", "version_value": "59.4"}]}}]}, "vendor_name": "Unknown"}]}}, "credit": [{"lang": "eng", "value": "Ramuel Gall"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The WooCommerce Upload Files WordPress plugin before 59.4 ran a single sanitization pass to remove blocked extensions such as .php. It was possible to bypass this and upload a file with a PHP extension by embedding a \"blocked\" extension within another \"blocked\" extension in the \"wcuf_file_name\" parameter. It was also possible to perform a double extension attack and upload files to a different location via path traversal using the \"wcuf_current_upload_session_id\" parameter."}]}, "generator": "WPScan CVE Generator", "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-434 Unrestricted Upload of File with Dangerous Type"}]}]}, "references": {"reference_data": [{"name": "https://wpscan.com/vulnerability/ed4288a1-f7e4-455f-b765-5ac343f87194", "refsource": "CONFIRM", "url": "https://wpscan.com/vulnerability/ed4288a1-f7e4-455f-b765-5ac343f87194"}, {"name": "https://www.wordfence.com/blog/2021/03/critical-vulnerability-patched-in-woocommerce-upload-files/", "refsource": "MISC", "url": "https://www.wordfence.com/blog/2021/03/critical-vulnerability-patched-in-woocommerce-upload-files/"}]}, "source": {"discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T19:21:18.699Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://wpscan.com/vulnerability/ed4288a1-f7e4-455f-b765-5ac343f87194"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.wordfence.com/blog/2021/03/critical-vulnerability-patched-in-woocommerce-upload-files/"}]}]}, "cveMetadata": {"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "assignerShortName": "WPScan", "cveId": "CVE-2021-24171", "datePublished": "2021-04-05T18:27:44", "dateReserved": "2021-01-14T00:00:00", "dateUpdated": "2024-08-03T19:21:18.699Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:vanquish:woocommerce_upload_files:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "4D755FA2-93D9-4FE2-BB9E-323398084C28", "versionEndExcluding": "59.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The WooCommerce Upload Files WordPress plugin before 59.4 ran a single sanitization pass to remove blocked extensions such as .php. It was possible to bypass this and upload a file with a PHP extension by embedding a \"blocked\" extension within another \"blocked\" extension in the \"wcuf_file_name\" parameter. It was also possible to perform a double extension attack and upload files to a different location via path traversal using the \"wcuf_current_upload_session_id\" parameter."}, {"lang": "es", "value": "El plugin de WordPress WooCommerce Upload Files versiones anteriores a 59.4 ejecut\u00f3 una sola pasada de saneamiento para eliminar extensiones bloqueadas como .php. Era posible omitir esto y cargar un archivo con una extensi\u00f3n PHP insertando una extensi\u00f3n \"blocked\" dentro de otra extensi\u00f3n \"blocked\" en el par\u00e1metro \"wcuf_file_name\". Tambi\u00e9n fue posible llevar a cabo un ataque de extensi\u00f3n doble y subir archivos a una ubicaci\u00f3n diferente por medio del salto de ruta usando el par\u00e1metro \"wcuf_current_upload_session_id\""}], "id": "CVE-2021-24171", "lastModified": "2024-11-25T18:14:49.230", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-04-05T19:15:15.857", "references": [{"source": "contact@wpscan.com", "tags": ["Third Party Advisory"], "url": "https://wpscan.com/vulnerability/ed4288a1-f7e4-455f-b765-5ac343f87194"}, {"source": "contact@wpscan.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/blog/2021/03/critical-vulnerability-patched-in-woocommerce-upload-files/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://wpscan.com/vulnerability/ed4288a1-f7e4-455f-b765-5ac343f87194"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/blog/2021/03/critical-vulnerability-patched-in-woocommerce-upload-files/"}], "sourceIdentifier": "contact@wpscan.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-434"}], "source": "contact@wpscan.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-434"}], "source": "nvd@nist.gov", "type": "Primary"}]}