WordPress BulletProof Security 5.1 Information Disclosure

mediumseverity

5.3CVSS score

71.7%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

The BulletProof Security WordPress plugin is vulnerable to sensitive information disclosure due to a file path disclosure in the publicly accessible ~/db_backup_log.txt file which grants attackers the full path of the site, in addition to the path of database backup files. This affects versions up to, and including, 5.1.

Impact

An attacker can gain sensitive information from the target system.

Fix

Update to the latest version of WordPress BulletProof Security.

How to confirm it

Send: GET {{BaseURL}}/wp-content/bps-backup/logs/db_backup_log.txt ; GET {{BaseURL}}/wp-content/plugins/bulletproof-security/admin/htaccess/db_backup_log.txt
Positive when: contains "BPS DB BACKUP LOG" and "==================" AND not matches /^BPS\sDB\sBACKUP\sLOG\r\n==================\r\n==================\r\n\r\n$/ AND contains in header "text/plain" AND status 200

Run it with nuclei: nuclei -id CVE-2021-39327 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2021-39327

info:
  name: WordPress BulletProof Security 5.1 Information Disclosure
  author: geeknik
  severity: medium
  description: The BulletProof Security WordPress plugin is vulnerable to sensitive information disclosure due to a file path disclosure in the publicly accessible ~/db_backup_log.txt file which grants attackers the full path of the site, in addition to the path of database backup files. This affects versions up to, and including, 5.1.
  impact: |
    An attacker can gain sensitive information from the target system.
  remediation: |
    Update to the latest version of WordPress BulletProof Security.
  reference:
    - https://packetstormsecurity.com/files/164420/wpbulletproofsecurity51-disclose.txt
    - https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39327
    - https://nvd.nist.gov/vuln/detail/CVE-2021-39327
    - http://packetstormsecurity.com/files/164420/WordPress-BulletProof-Security-5.1-Information-Disclosure.html
    - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2591118%40bulletproof-security&new=2591118%40bulletproof-security&sfp_email=&sfph_mail=
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2021-39327
    cwe-id: CWE-459,CWE-200
    epss-score: 0.71688
    epss-percentile: 0.99426
    cpe: cpe:2.3:a:ait-pro:bulletproof_security:*:*:*:*:*:wordpress:*:*
  metadata:
    max-request: 2
    vendor: ait-pro
    product: bulletproof_security
    framework: wordpress
  tags: cve2021,cve,exposure,packetstorm,wordpress,ait-pro,vuln

http:
  - method: GET
    path:
      - '{{BaseURL}}/wp-content/bps-backup/logs/db_backup_log.txt'
      - '{{BaseURL}}/wp-content/plugins/bulletproof-security/admin/htaccess/db_backup_log.txt'

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'BPS DB BACKUP LOG'
          - '=================='
        condition: and

      - type: regex
        negative: true
        part: body
        regex:
          - '^BPS\sDB\sBACKUP\sLOG\r\n==================\r\n==================\r\n\r\n$'

      - type: word
        part: header
        words:
          - 'text/plain'

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from