Thrive “Legacy” Rise by Thrive Themes WordPress theme before 2.0.0, Luxe by Thrive Themes WordPress theme before 2.0.0, Minus by Thrive Themes WordPress theme before 2.0.0, Ignition by Thrive Themes WordPress theme before 2.0.0, FocusBlog by Thrive Themes WordPress theme before 2.0.0, Squared by Thrive Themes WordPress theme before 2.0.0, Voice WordPress theme before 2.0.0, Performag by Thrive Themes WordPress theme before 2.0.0, Pressive by Thrive Themes WordPress theme before 2.0.0, Storied by Thrive Themes WordPress theme before 2.0.0 register a REST API endpoint to compress images using the Kraken image optimization engine. By supplying a crafted request in combination with data inserted using the Option Update vulnerability, it was possible to use this endpoint to retrieve malicious code from a remote URL and overwrite an existing file on the site with it or create a new file.This includes executable PHP files that contain malicious code.
PoC
id: CVE-2021-24220
info:
name: Multiple Thrive Themes < 2.0.0 - Arbitrary File Upload
author: pussycat0x
severity: critical
description: |
Thrive “Legacy” Rise by Thrive Themes WordPress theme before 2.0.0, Luxe by Thrive Themes WordPress theme before 2.0.0, Minus by Thrive Themes WordPress theme before 2.0.0, Ignition by Thrive Themes WordPress theme before 2.0.0, FocusBlog by Thrive Themes WordPress theme before 2.0.0, Squared by Thrive Themes WordPress theme before 2.0.0, Voice WordPress theme before 2.0.0, Performag by Thrive Themes WordPress theme before 2.0.0, Pressive by Thrive Themes WordPress theme before 2.0.0, Storied by Thrive Themes WordPress theme before 2.0.0 register a REST API endpoint to compress images using the Kraken image optimization engine. By supplying a crafted request in combination with data inserted using the Option Update vulnerability, it was possible to use this endpoint to retrieve malicious code from a remote URL and overwrite an existing file on the site with it or create a new file.This includes executable PHP files that contain malicious code.
impact: |
Attackers can execute arbitrary PHP code, potentially leading to full site compromise and malicious control.
remediation: |
Update all affected themes to version 2.0.0 or later to fix the vulnerability.
reference:
- https://www.wordfence.com/blog/2021/03/recently-patched-vulnerability-in-thrive-themes-actively-exploited-in-the-wild
- https://wpscan.com/vulnerability/a2424354-2639-4f53-a24f-afc11f6c4cac
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
cvss-score: 9.1
cve-id: CVE-2021-24220
cwe-id: CWE-434
epss-score: 0.03946
epss-percentile: 0.89877
cpe: cpe:2.3:a:thrivethemes:focusblog:*:*:*:*:*:wordpress_:*:*
metadata:
verified: true
vendor: thrivethemes
product: focusblog
framework: wordpress
tags: cve,cve2021,wordpress,wp,wpscan,wp-theme,thrive,passive,vkev,vuln
http:
- method: GET
path:
- "{{BaseURL}}/wp-content/themes/{{theme}}/style.css"
attack: batteringram
payloads:
theme:
- rise
- luxe
- minus
- ignition
- focusblog
- squared
- voice
- performag
- pressive
- storied
matchers-condition: and
matchers:
- type: dsl
dsl:
- "status_code == 200"
- compare_versions(version, '< 2.0.0')
- contains(body, 'Theme Name')
condition: and
- type: word
part: body
words:
- "rise"
- "luxe"
- "minus"
- "ignition"
- "focusblog"
- "squared"
- "voice"
- "performag"
- "pressive"
- "storied"
condition: or
case-insensitive: true
extractors:
- type: regex
part: body
name: version
group: 1
regex:
- 'Version: ([0-9.]+)'
# digest: 4a0a00473045022100e159331e5feee34adc74f029e0c22b430faeb2d1aebcc3b7cf85747bc57c492a0220163cc8fde6fbd21b26f8c9dbab4aafd1b4447be9a7667e1222d839adb62dd71b:922c64590222798bb761d5b6d8e72950
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.