nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2021-24220 CVE-2021-24220
CRITICALNuclei
All Thrive Themes Legacy Themes < 2.0.0 - Unauthenticated Arbitrary File Upload and Option Deletion
Record summary
CVE-2021-24220 has a selected CVSS score of 9.1 (critical); EIP currently links 1 Nuclei template.
Description
Thrive “Legacy” Rise by Thrive Themes WordPress theme before 2.0.0, Luxe by Thrive Themes WordPress theme before 2.0.0, Minus by Thrive Themes WordPress theme before 2.0.0, Ignition by Thrive Themes WordPress theme before 2.0.0, FocusBlog by Thrive Themes WordPress theme before 2.0.0, Squared by Thrive Themes WordPress theme before 2.0.0, Voice WordPress theme before 2.0.0, Performag by Thrive Themes WordPress theme before 2.0.0, Pressive by Thrive Themes WordPress theme before 2.0.0, Storied by Thrive Themes WordPress theme before 2.0.0 register a REST API endpoint to compress images using the Kraken image optimization engine. By supplying a crafted request in combination with data inserted using the Option Update vulnerability, it was possible to use this endpoint to retrieve malicious code from a remote URL and overwrite an existing file on the site with it or create a new file.This includes executable PHP files that contain malicious code.
Description source: CVE List
Exploitation context
Known exploitation
- VulnCheck KEV
- Listed · Mar 24, 2021 · VulnCheck
- Reported exploitation
- Observed · VulnCheck
Available material
- Nuclei templates
- 1
Affected products and versions
11| Product | Source | Version range | Status |
|---|---|---|---|
FocusBlog by Thrive ThemesBrowse Thrive Themes / FocusBlog by Thrive Themes | CVE List | 2.0.0 to < 2.0.0 | affected |
Ignition by Thrive ThemesBrowse Thrive Themes / Ignition by Thrive Themes | CVE List | 2.0.0 to < 2.0.0 | affected |
Luxe by Thrive ThemesBrowse Thrive Themes / Luxe by Thrive Themes | CVE List | 2.0.0 to < 2.0.0 | affected |
Minus by Thrive ThemesBrowse Thrive Themes / Minus by Thrive Themes | CVE List | 2.0.0 to < 2.0.0 | affected |
Performag by Thrive ThemesBrowse Thrive Themes / Performag by Thrive Themes | CVE List | 2.0.0 to < 2.0.0 | affected |
Pressive by Thrive ThemesBrowse Thrive Themes / Pressive by Thrive Themes | CVE List | 2.0.0 to < 2.0.0 | affected |
Rise by Thrive ThemesBrowse Thrive Themes / Rise by Thrive Themes | CVE List | 2.0.0 to < 2.0.0 | affected |
Squared by Thrive ThemesBrowse Thrive Themes / Squared by Thrive Themes | CVE List | 2.0.0 to < 2.0.0 | affected |
Storied by Thrive ThemesBrowse Thrive Themes / Storied by Thrive Themes | CVE List | 2.0.0 to < 2.0.0 | affected |
| CVE List | 2.0.0 to < 2.0.0 | affected | |
focusblogBrowse thrivethemes / focusblog | VulnCheck | Version data not supplied | |
Nuclei templates
1ProjectDiscoveryCRITICALMultiple Thrive Themes < 2.0.0 - Arbitrary File UploadCVSS 9.1
Thrive “Legacy” Rise by Thrive Themes WordPress theme before 2.0.0, Luxe by Thrive Themes WordPress theme before 2.0.0, Minus by Thrive Themes WordPress theme before 2.0.0, Ignition by Thrive Themes WordPress theme before 2.0.0, FocusBlog by Thrive Themes WordPress theme before 2.0.0, Squared by Thrive Themes WordPress theme before 2.0.0, Voice WordPress theme before 2.0.0, Performag by Thrive Themes WordPress theme before 2.0.0, Pressive by Thrive Themes WordPress theme before 2.0.0, Storied by Thrive Themes WordPress theme before 2.0.0 register a REST API endpoint to compress images using the Kraken image optimization engine. By supplying a crafted request in combination with data inserted using the Option Update vulnerability, it was possible to use this endpoint to retrieve malicious code from a remote URL and overwrite an existing file on the site with it or create a new file.This includes executable PHP files that contain malicious code.
Impact
Attackers can execute arbitrary PHP code, potentially leading to full site compromise and malicious control.
Remediation
Update all affected themes to version 2.0.0 or later to fix the vulnerability.
WeaknessesCWE-434
Authorspussycat0x
Template tagscvecve2021wordpresswpwpscanwp-themethrivepassivevkev
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CPE: cpe:2.3:a:thrivethemes:focusblog:*:*:*:*:*:wordpress_:*:*
https://www.wordfence.com/blog/2021/03/recently-patched-vulnerability-in-thrive-themes-actively-exploited-in-the-wild https://wpscan.com/vulnerability/a2424354-2639-4f53-a24f-afc11f6c4cac
Source: ProjectDiscovery
References
3wpscan.comConfirmation
https://wpscan.com/vulnerability/a2424354-2639-4f53-a24f-afc11f6c4cac wordfence.com
https://www.wordfence.com/blog/2021/03/recently-patched-vulnerability-in-thrive-themes-actively-exploited-in-the-wild