PT-2021-22531 · WordPress · Sassy Social Share

Published 2021-10-21 · Updated 2021-10-25 · CVE-2021-39321

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Sassy Social Share WordPress plugin version 3.3.23

Description: The issue arises from PHP Object Injection via the wp ajax heateor sss import config AJAX action, due to the deserialization of unvalidated user-supplied inputs via the import config function found in the ~/admin/class-sassy-social-share-admin.php file. This can be exploited by underprivileged authenticated users because of a missing capability check on the import config function.

Recommendations: For version 3.3.23, consider disabling the import config function until a patch is available to prevent exploitation via the wp ajax heateor sss import config AJAX action. Restrict access to the ~/admin/class-sassy-social-share-admin.php file to minimize the risk of exploitation. Avoid using the import config function in the affected AJAX endpoint until the issue is resolved.

Exploit

Fix

Deserialization of Untrusted Data

Incorrect Authorization

Weakness Enumeration

CWE-502

CWE-863

Related Identifiers

CVE-2021-39321

Affected Products

Sassy Social Share

References · 6

• 🔥 https://wordfence.com/blog/2021/10/vulnerability-patched-in-sassy-social-share-plugin · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-39321 · Security Note
• https://osv.dev/vulnerability/CVE-2021-39321 · Vendor Advisory
• https://plugins.trac.wordpress.org/changeset/2600464/sassy-social-share/trunk/admin/class-sassy-social-share-admin.php · Patch
• https://t.me/cibsecurity/30985 · Telegram Post
• https://wordfence.com/vulnerability-advisories/#CVE-2021-39321 · Note