CVE-2021-38314

Gutenberg Template Library & Redux Framework <= 4.2.11 - Missing Authorization to Sensitive Information Disclosure

2021-09-01 00:00
Ram

Strategic Overview

Status
Patched in 4.2.13
Affected Plugin
Redux Framework
Affected Version
<= 4.2.11
CVSS
5.3Medium
Weakness type
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
CVE
CVE-2021-38314
View all Redux Framework vulnerabilities

At a glance

CVE-2021-38314 is a medium-severity Exposure of Sensitive Information to an Unauthorized Actor vulnerability in the Redux Framework WordPress plugin, affecting versions <= 4.2.11. It carries a CVSS score of 5.3 (reachable over the network; low attack complexity). Exploitation requires no authentication. The issue is fixed in version 4.2.13; sites on affected versions should update now. Disclosed September 2021, reported by Ram.

Vulnerability Overview

The Gutenberg Template Library & Redux Framework plugin <= 4.2.11 for WordPress registered several AJAX actions available to unauthenticated users in the `includes` function in `redux-core/class-redux-core.php` that were unique to a given site but deterministic and predictable given that they were based on an md5 hash of the site URL with a known salt value of '-redux' and an md5 hash of the previous hash with a known salt value of '-support'. These AJAX actions could be used to retrieve a list of active plugins and their versions, the site's PHP version, and an unsalted md5 hash of site’s `AUTH_KEY` concatenated with the `SECURE_AUTH_KEY`.

Technical Analysis

The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no privileges on the target site, and no interaction from a victim user.

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Reaching this weakness in Redux Framework <= 4.2.11 takes a caller who can reach the endpoint. Sensitive information exposure means data the application intended to keep internal is returned to a caller who should not be able to see it.

The disclosed data — credentials, tokens, customer records or internal paths — is usually worth more as material for a follow-up attack than as an end in itself. For Redux Framework the fix is 4.2.13: builds <= 4.2.11 are affected, anything from 4.2.13 onward is not.

Remediation

Update to version 4.2.13, or a newer patched version

How does WordSec protect against this?

The fix is the thing that ends this: Redux Framework 4.2.13 closes this, and updating the plugin is the step that ends it.

  • Alerts

External References

https://www.cve.org/CVERecord?id=CVE-2021-38314https://www.wordfence.com/threat-intel/vulnerabilities/id/5b5c2a74-c1e8-4381-8d0d-66a2ed3b937ehttps://nvd.nist.gov/vuln/detail/CVE-2021-38314

Related records

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C