PT-2021-15717 · WordPress · Woocommerce Upload Files

Ramuel Gall · Published 2021-04-05 · Updated 2024-11-25 · CVE-2021-24171

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: WooCommerce Upload Files WordPress plugin versions prior to 59.4

Description: The issue allows bypassing the sanitization pass that removes blocked extensions, such as .php, by embedding a blocked extension within another blocked extension in the wcuf file name parameter. Additionally, it is possible to perform a double extension attack and upload files to a different location via path traversal using the wcuf current upload session id parameter.

Recommendations: For versions prior to 59.4, update to version 59.4 or later to resolve the issue. As a temporary workaround, consider restricting the use of the wcuf file name and wcuf current upload session id parameters until a patch is available.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2021-24171

Affected Products

Woocommerce Upload Files

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-24171 · Security Note
• https://osv.dev/vulnerability/CVE-2021-24171 · Vendor Advisory
• https://t.me/cvenotify/102528 · Telegram Post
• https://wpscan.com/vulnerability/ed4288a1-f7e4-455f-b765-5ac343f87194 · Note
• https://wordfence.com/blog/2021/03/critical-vulnerability-patched-in-woocommerce-upload-files · Note