CVE-2021-24981: Directorist < 7.0.6.2 - Cross-Site Request Forgery to Arbitrary File Upload

id: CVE-2021-24981

info:
  name: Directorist < 7.0.6.2 - Cross-Site Request Forgery to Arbitrary File Upload
  author: DhiyaneshDk
  severity: high
  description: |
    The Directorist plugin for WordPress before 7.0.6.2 does not verify a CSRF nonce on its front-end listing submission handler (the add_listing_action AJAX action, registered for unauthenticated users via wp_ajax_nopriv). An attacker can forge a listing submission - including file uploads - on behalf of a logged-in user, leading to arbitrary file upload and potential remote code execution. The fix adds directorist_verify_nonce() to atbdp_submit_listing(). This template detects the missing nonce check by sending a listing submission with no nonce: a vulnerable build processes it (failing later at field validation) while a patched build rejects it at the nonce gate.
  impact: |
    Cross-site request forgery allowing arbitrary file upload, which can lead to remote code execution on the server.
  remediation: |
    Update Directorist to 7.0.6.2 or later, which verifies the directorist nonce before processing a listing submission.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2021-24981
    - https://github.com/advisories/GHSA-g47h-745c-4p4f
    - https://wpscan.com/vulnerability/4c45df6d-b3f6-49e5-8b1f-edd32a12d71c/
    - https://plugins.trac.wordpress.org/changeset?old_path=/directorist/tags/7.0.6.1&new_path=/directorist/tags/7.0.6.2
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    cve-id: CVE-2021-24981
    epss-score: 0.00837
    epss-percentile: 0.58079
    cwe-id: CWE-352
  metadata:
    verified: true
    max-request: 1
    vendor: wpwax
    product: directorist
    framework: wordpress
    publicwww-query: "/wp-content/plugins/directorist/"
  tags: cve,cve2021,wordpress,wp-plugin,directorist,csrf,file-upload,vkev

http:
  - raw:
      - |
        POST /wp-admin/admin-ajax.php?action=add_listing_action HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        directory_type=&listing_title={{rand_text_alpha(6)}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"error_msg"'
          - 'Something Wrong with Your Submission'
        condition: and

      - type: word
        part: body
        words:
          - 'nonce did not verify'
        negative: true

      - type: status
        status:
          - 200
# digest: 4a0a00473045022100ac5a17dff110f672a217809017f8c6f696a4e7e4719c9b10f4d91b532032bbfc0220662dced763d6c33aec3675fc863f7ae45d0be6ad7446f5b24d6a8782759a1be9:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.