AccessAlly <3.5.7 - Sensitive Information Leakage

highseverity

7.5CVSS score

5.3%likelihood of exploitation, next 30 days

93%of all CVEs are less likely

Readycheck to confirm it

WordPress AccessAlly plugin before 3.5.7 allows sensitive information leakage because the file \"resource/frontend/product/product-shortcode.php\" (which is responsible for the [accessally_order_form] shortcode) dumps serialize($_SERVER), which contains all environment variables. The leakage occurs on all public facing pages containing the [accessally_order_form] shortcode, and no login or administrator role is required.

Impact

An attacker can exploit this vulnerability to gain access to sensitive information.

Fix

Upgrade AccessAlly to version 3.5.7 or higher to fix the vulnerability.

How to confirm it

Send: GET {{BaseURL}}
Positive when: contains "<div id=\"accessally-testing-data\"" AND status 200

Run it with nuclei: nuclei -id CVE-2021-24226 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2021-24226

info:
  name: AccessAlly <3.5.7 - Sensitive Information Leakage
  author: dhiyaneshDK
  severity: high
  description: WordPress AccessAlly plugin before 3.5.7 allows sensitive information leakage because the file \"resource/frontend/product/product-shortcode.php\" (which is responsible for the [accessally_order_form] shortcode) dumps serialize($_SERVER), which contains all environment variables. The leakage occurs on all public facing pages containing the [accessally_order_form] shortcode, and no login or administrator role is required.
  impact: |
    An attacker can exploit this vulnerability to gain access to sensitive information.
  remediation: |
    Upgrade AccessAlly to version 3.5.7 or higher to fix the vulnerability.
  reference:
    - https://wpscan.com/vulnerability/8e3e89fd-e380-4108-be23-00e87fbaad16
    - https://nvd.nist.gov/vuln/detail/CVE-2021-24226
    - https://github.com/ARPSyndicate/kenzer-templates
    - https://github.com/ARPSyndicate/cvemon
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2021-24226
    cwe-id: CWE-200
    epss-score: 0.05259
    epss-percentile: 0.92613
    cpe: cpe:2.3:a:accessally:accessally:*:*:*:*:*:wordpress:*:*
  metadata:
    max-request: 1
    vendor: accessally
    product: accessally
    framework: wordpress
  tags: cve2021,cve,wordpress,wp-plugin,wpscan,accessally,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '<div id="accessally-testing-data"'
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from