CVE-2021-21389
BuddyPress < 7.2.1 - REST API Privilege Escalation to RCE
PoC (Full)
Affected version: 5.0.0 to 7.2.0
User requirement: Subscriber user
Method: Privilege Escalation to Administrator and trigger RCE via REST API
Endpoint: /v1/members/me endpoint.
How to use Docker
git clone https://github.com/HoangKien1020/CVE-2021-21389
cd CVE-2021-21389/
docker build . -t hoangkien1020/buddypress:cve202121389
docker run -d --rm -it -p 8080:80 hoangkien1020/buddypress:cve202121389
Other way to pull this docker instead of building:
docker pull hoangkien1020/buddypress:cve202121389
docker run -d --rm -it -p 8080:80 hoangkien1020/buddypress:cve202121389
Access your host/IP
Ex: http://test.local:8080
How to exploit
python3 CVE-2021-21389.py http://test.local:8080 test 1234 whoami
Example:
Reference
https://buddypress.org/2021/03/buddypress-7-2-1-security-release/
48 Aug 28, 2022
3 Jun 05, 2022
177 Dec 22, 2022
52 Nov 09, 2022
56 Mar 03, 2021
7 Jan 03, 2022
44 Nov 21, 2022
14 Nov 09, 2022
14 Dec 23, 2022
287 Nov 09, 2022
212 Dec 29, 2022
153 Dec 20, 2022
13 Jul 13, 2022
224 Aug 05, 2022
16 Nov 09, 2022
135 Dec 31, 2022
4.9k Jan 08, 2023
23 Dec 02, 2022
10 Jul 31, 2022
26 Dec 29, 2022