BuddyPress REST API <7.2.1 - Privilege Escalation/Remote Code Execution

highseverity

8.8CVSS score

14.8%likelihood of exploitation, next 30 days

97%of all CVEs are less likely

Readycheck to confirm it

WordPress BuddyPress before version 7.2.1 is susceptible to a privilege escalation vulnerability that can be leveraged to perform remote code execution.

Impact

Successful exploitation of this vulnerability could allow an attacker to gain unauthorized access to sensitive information, escalate privileges, or execute arbitrary code on the affected system.

Fix

This issue has been remediated in WordPress BuddyPress 7.2.1.

How to confirm it

Send: POST /wp-json/buddypress/v1/signup
Positive when: contains "user_login" and "registered" and "activation_key" and "user_email" AND contains in header "application/json" AND status 200

Run it with nuclei: nuclei -id CVE-2021-21389 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2021-21389

info:
  name: BuddyPress REST API  <7.2.1 - Privilege Escalation/Remote Code Execution
  author: lotusdll
  severity: high
  description: WordPress BuddyPress before version 7.2.1 is susceptible to a privilege escalation vulnerability that can be leveraged to perform remote code execution.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to gain unauthorized access to sensitive information, escalate privileges, or execute arbitrary code on the affected system.
  remediation: This issue has been remediated in WordPress BuddyPress 7.2.1.
  reference:
    - https://github.com/HoangKien1020/CVE-2021-21389
    - https://buddypress.org/2021/03/buddypress-7-2-1-security-release/
    - https://codex.buddypress.org/releases/version-7-2-1/
    - https://github.com/buddypress/BuddyPress/security/advisories/GHSA-m6j4-8r7p-wpp3
    - https://nvd.nist.gov/vuln/detail/CVE-2021-21389
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    cve-id: CVE-2021-21389
    cwe-id: CWE-863
    epss-score: 0.14811
    epss-percentile: 0.96712
    cpe: cpe:2.3:a:buddypress:buddypress:*:*:*:*:*:wordpress:*:*
  metadata:
    max-request: 1
    vendor: buddypress
    product: buddypress
    framework: wordpress
  tags: cve2021,cve,wordpress,wp-plugin,rce,wp,buddypress,vkev,vuln

http:
  - raw:
      - |
        POST /wp-json/buddypress/v1/signup HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json; charset=UTF-8

        {
          "user_login":"{{randstr}}",
          "password":"{{randstr}}",
          "user_name":"{{randstr}}",
          "user_email":"{{randstr}}@interact.sh"
        }

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "user_login"
          - "registered"
          - "activation_key"
          - "user_email"
        condition: and

      - type: word
        part: header
        words:
          - "application/json"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from