CVE-2021-25094
HIGH EXPLOITED IN THE WILD NUCLEITatsu Wordpress Plugin RCE
Title source: metasploitExploitation Summary
CVE-2021-25094 has been observed exploited in the wild (reported by VulnCheck KEV, InTheWild.io).
EIP tracks 6 public exploits from researchers including Milad karimi, darkpills, experimentalcrow1, including a Metasploit module exploits/multi/http/wp_tatsu_rce.
A Nuclei detection template is also available.
AI-analyzed exploit summary This exploit leverages an unauthenticated file upload vulnerability in the Tatsu WordPress plugin (CVE-2021-25094) to achieve remote code execution. It uploads a malicious ZIP archive containing a PHP shell via the 'add_custom_font' AJAX action, then triggers the shell to execute arbitrary commands.
Description
The Tatsu WordPress plugin before 3.3.12 add_custom_font action can be used without prior authentication to upload a rogue zip file which is uncompressed under the WordPress's upload directory. By adding a PHP shell with a filename starting with a dot ".", this can bypass extension control implemented in the plugin. Moreover, there is a race condition in the zip extraction process which makes the shell file live long enough on the filesystem to be callable by an attacker.
Exploits (6)
This exploit leverages an unauthenticated file upload vulnerability in the Tatsu WordPress plugin (CVE-2021-25094) to achieve remote code execution. It uploads a malicious ZIP archive containing a PHP shell via the 'add_custom_font' AJAX action, then triggers the shell to execute arbitrary commands.
This repository contains a functional exploit for CVE-2021-25094, an unauthenticated RCE vulnerability in the Tatsu Builder WordPress plugin. The exploit leverages a race condition during file upload and extraction to achieve remote code execution.
This repository contains a functional exploit for CVE-2021-25094, a vulnerability in the TypeHub WordPress plugin that allows arbitrary file upload leading to remote code execution (RCE). The exploit uploads a malicious ZIP file containing a PHP shell to the target WordPress site via the plugin's admin-ajax.php endpoint.
This repository contains a functional exploit for CVE-2021-25094, a pre-authentication RCE vulnerability in the WordPress Tatsu Builder plugin. The exploit uploads a malicious ZIP file via the 'add_custom_font' action, leading to arbitrary file upload and remote code execution.
This repository contains a functional PHP exploit for CVE-2021-25094, which targets an unrestricted file upload vulnerability in the Tatsu Plugin for WordPress. The exploit automates the process of uploading a malicious ZIP file via the `add_custom_font` AJAX action, potentially leading to remote code execution.
This Metasploit module exploits CVE-2021-25094, an unauthenticated RCE in the Tatsu WordPress plugin <= 3.3.11. It uploads a malicious ZIP containing a PHP payload via a file upload vulnerability and triggers execution by accessing the uploaded file.
Nuclei Templates (1)
References (5)
Scores
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H