Multiple Thrive Themes < 2.0.0 - Arbitrary File Upload

id: CVE-2021-24220

info:
  name: Multiple Thrive Themes < 2.0.0 -  Arbitrary File Upload
  author: pussycat0x
  severity: critical
  description: |
    Thrive “Legacy” Rise by Thrive Themes WordPress theme before 2.0.0, Luxe by Thrive Themes WordPress theme before 2.0.0, Minus by Thrive Themes WordPress theme before 2.0.0, Ignition by Thrive Themes WordPress theme before 2.0.0, FocusBlog by Thrive Themes WordPress theme before 2.0.0, Squared by Thrive Themes WordPress theme before 2.0.0, Voice WordPress theme before 2.0.0, Performag by Thrive Themes WordPress theme before 2.0.0, Pressive by Thrive Themes WordPress theme before 2.0.0, Storied by Thrive Themes WordPress theme before 2.0.0 register a REST API endpoint to compress images using the Kraken image optimization engine. By supplying a crafted request in combination with data inserted using the Option Update vulnerability, it was possible to use this endpoint to retrieve malicious code from a remote URL and overwrite an existing file on the site with it or create a new file.This includes executable PHP files that contain malicious code.
  impact: |
    Attackers can execute arbitrary PHP code, potentially leading to full site compromise and malicious control.
  remediation: |
    Update all affected themes to version 2.0.0 or later to fix the vulnerability.
  reference:
    - https://www.wordfence.com/blog/2021/03/recently-patched-vulnerability-in-thrive-themes-actively-exploited-in-the-wild
    - https://wpscan.com/vulnerability/a2424354-2639-4f53-a24f-afc11f6c4cac
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
    cvss-score: 9.1
    cve-id: CVE-2021-24220
    cwe-id: CWE-434
    epss-score: 0.03946
    epss-percentile: 0.90497
    cpe: cpe:2.3:a:thrivethemes:focusblog:*:*:*:*:*:wordpress_:*:*
  metadata:
    verified: true
    vendor: thrivethemes
    product: focusblog
    framework: wordpress
  tags: cve,cve2021,wordpress,wp,wpscan,wp-theme,thrive,passive,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/themes/{{theme}}/style.css"

    attack: batteringram
    payloads:
      theme:
        - rise
        - luxe
        - minus
        - ignition
        - focusblog
        - squared
        - voice
        - performag
        - pressive
        - storied

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - compare_versions(version, '< 2.0.0')
          - contains(body, 'Theme Name')
        condition: and

      - type: word
        part: body
        words:
          - "rise"
          - "luxe"
          - "minus"
          - "ignition"
          - "focusblog"
          - "squared"
          - "voice"
          - "performag"
          - "pressive"
          - "storied"
        condition: or
        case-insensitive: true

    extractors:
      - type: regex
        part: body
        name: version
        group: 1
        regex:
          - 'Version: ([0-9.]+)'