CVE-2021-25094 Scanner

WordPress Tatsubuilder is a popular plugin used extensively by WordPress website administrators to build, enhance, and customize their web pages. This plugin is widely chosen for its user-friendly interface and extensive functionality that facilitates professional-grade website designs with ease. Employed mostly by small to medium-sized businesses, it helps individuals and organizations enhance their online presence by providing customizable design elements. The plugin has garnered attention for its robust capabilities, empowering developers to implement complex layouts without deep technical knowledge. Its integrations with WordPress make it a preferred choice for those looking to enhance site engagement and functionality. However, like all software, it is imperative that it is secure to prevent potential exploitation by malicious actors.

The Remote Code Execution vulnerability happens when an attacker takes advantage of an unprotected upload mechanism in a plugin. This vulnerability allows unauthorized individuals to execute remote commands on the vulnerable system, potentially leading to complete system compromise. Exploitability is high as attackers can upload malicious scripts or files exploiting the insufficient validation or restrictions under certain conditions. The vulnerability is significant due to its impact and potential to allow full code execution remotely. Therefore, this kind of vulnerability poses a severe risk to the integrity and security of affected websites.

Technically, the vulnerability resides in the font import feature where unrestricted file upload can occur. The vulnerable endpoint in this scenario is within the WordPress Tatsubuilder’s implementation for handling file uploads via the admin-ajax.php interface. Due to lack of sufficient validation, an attacker can manipulate the 'file' parameter while uploading, which can include executable code executed on the server. By crafting a specially designed request to the ‘action’ parameter with the malicious file, the attacker can trigger unauthorized code execution. It hinges on exploiting inherent weaknesses that were initially meant to offer flexibility but ended up creating critical security gaps.

If exploited successfully, the vulnerability could allow attackers to upload malicious code, leading to unauthorized access, data theft, or control over the affected website. Attackers might gain the ability to alter, steal, or delete data, making the website vulnerable to additional exploits or defacements. Furthermore, compromised websites could potentially be used to stage further attacks against visiting users or connected systems. This can result in serious operational, reputational, and financial damages, emphasizing the need for robust security measures and regular patch applications.

REFERENCES

• https://darkpills.com/wordpress-tatsu-builder-preauth-rce-cve-2021-25094/
• https://wpscan.com/vulnerability/fb0097a0-5d7b-4e5b-97de-aacafa8fffcd/
• https://nvd.nist.gov/vuln/detail/CVE-2021-25094