Browse / CVEs / CVE-2021-25074

CVE-2021-25074· webp converter for media project / webp converter for media· CWE-601

WordPress WebP Converter for Media < 4.0.3 - Unauthenticated Open Redirect

mediumseverity

6.1CVSS score

2.2%likelihood of exploitation, next 30 days

82%of all CVEs are less likely

Readycheck to confirm it

WordPress WebP Converter for Media < 4.0.3 contains a file (passthru.php) which does not validate the src parameter before redirecting the user to it, leading to an open redirect issue.

Impact

An attacker can trick users into visiting a malicious website, leading to potential phishing attacks or the disclosure of sensitive information.

Fix

Update to the latest version of the WordPress WebP Converter for Media plugin (4.0.3) or remove the plugin if not needed.

How to confirm it

Send: GET {{BaseURL}}/wp-content/plugins/webp-converter-for-media/includes/passthru.php?src=https://interact.sh
Positive when: matches in header /(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)(?:[a-zA-Z0-9\-_\.@]*…/

Run it with nuclei: nuclei -id CVE-2021-25074 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2021-25074

info:
  name: WordPress WebP Converter for Media < 4.0.3 - Unauthenticated Open Redirect
  author: dhiyaneshDk
  severity: medium
  description: WordPress WebP Converter for Media < 4.0.3 contains a file (passthru.php) which does not validate the src parameter before redirecting the user to it, leading to an open redirect issue.
  impact: |
    An attacker can trick users into visiting a malicious website, leading to potential phishing attacks or the disclosure of sensitive information.
  remediation: |
    Update to the latest version of the WordPress WebP Converter for Media plugin (4.0.3) or remove the plugin if not needed.
  reference:
    - https://wpscan.com/vulnerability/f3c0a155-9563-4533-97d4-03b9bac83164
    - https://nvd.nist.gov/vuln/detail/CVE-2021-25074
    - https://github.com/ARPSyndicate/kenzer-templates
    - https://github.com/ARPSyndicate/cvemon
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2021-25074
    cwe-id: CWE-601
    epss-score: 0.02161
    epss-percentile: 0.82363
    cpe: cpe:2.3:a:webp_converter_for_media_project:webp_converter_for_media:*:*:*:*:*:wordpress:*:*
  metadata:
    max-request: 1
    vendor: webp_converter_for_media_project
    product: webp_converter_for_media
    framework: wordpress
  tags: cve2021,cve,redirect,wp-plugin,webpconverter,wpscan,wordpress,webp_converter_for_media_project,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/webp-converter-for-media/includes/passthru.php?src=https://interact.sh"

    matchers:
      - type: regex
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/L403F0/1

References

Use this check only on systems you are authorised to test. Where the data comes from