🔙 목록으로 돌아가기

CVE-2021-24226: AccessAlly <3.5.7 - Sensitive Information Leakage

TitleAccessAlly <3.5.7 - Sensitive Information Leakage
AuthordhiyaneshDK
SeverityHigh
ImpactAn attacker can exploit this vulnerability to gain access to sensitive information.
RemediationUpgrade AccessAlly to version 3.5.7 or higher to fix the vulnerability.
CVSS Score7.5
EPSS Score0.25403
CVE IDCVE-2021-24226
CWE IDCWE-200
Tags cve2021 cve wordpress wp-plugin wpscan accessally vuln

🔍 Vulnerability Description

WordPress AccessAlly plugin before 3.5.7 allows sensitive information leakage because the file "resource/frontend/product/product-shortcode.php" (which is responsible for the [accessally_order_form] shortcode) dumps serialize($_SERVER), which contains all environment variables. The leakage occurs on all public facing pages containing the [accessally_order_form] shortcode, and no login or administrator role is required.

🌐 HTTP Request

GET / HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.0 Safari/605.1.15
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24226.yaml

🦈 Packet Capture: ⬇️ Download cve-2021-24226.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A