CVE-2021-24472

CRITICALNuclei

Onair2 < 3.9.9.2 & KenthaRadio < 2.0.2 - Unauthenticated RFI and SSRF

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2021-24472 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

The OnAir2 WordPress theme before 3.9.9.2 and QT KenthaRadio WordPress plugin before 2.0.2 have exposed proxy functionality to unauthenticated users, sending requests to this proxy functionality will have the web server fetch and display the content from any URI, this would allow for SSRF (Server Side Request Forgery) and RFI (Remote File Inclusion) vulnerabilities on the website.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Affected products and versions

2
ProductSourceVersion range

OnAir2

Browse QantumThemes / OnAir2
CVE List3.9.9.2 to < 3.9.9.2affected

QT KenthaRadio

Browse QantumThemes / QT KenthaRadio
CVE List2.0.2 to < 2.0.2affected

Nuclei templates

1
ProjectDiscoveryCRITICALOnair2 < 3.9.9.2 & KenthaRadio < 2.0.2 - Remote File Inclusion/Server-Side Request ForgeryCVSS 9.8

Onair2 < 3.9.9.2 and KenthaRadio < 2.0.2 have exposed proxy functionality to unauthenticated users. Sending requests to this proxy functionality will have the web server fetch and display the content from any URI, allowing remote file inclusion and server-side request forgery.

Impact

Remote File Inclusion/Server-Side Request Forgery vulnerability allows an attacker to include arbitrary files or make requests to internal resources, leading to potential data leakage, unauthorized access.

Remediation

Update Onair2 to version 3.9.9.2 or higher and KenthaRadio to version 2.0.2 or higher to mitigate the vulnerability.

WeaknessesCWE-918
AuthorsSuman_Kar
Template tagscve2021cvewordpresslfissrfwpwp-pluginwpscanqantumthemesvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:qantumthemes:kentharadio:*:*:*:*:*:wordpress:*:*
Shodan: http.html:/wp-content/plugins/qt-kentharadio
FOFA: body=/wp-content/plugins/qt-kentharadio
https://wpscan.com/vulnerability/17591ac5-88fa-4cae-a61a-4dcf5dc0b72a https://nvd.nist.gov/vuln/detail/CVE-2021-24472 https://github.com/ARPSyndicate/cvemon https://github.com/ARPSyndicate/kenzer-templates

Source: ProjectDiscovery

References

2