CVE-2021-38314 Gutenberg Template Library & Redux Framework <= 4.2.11 Sensitive Information Disclosure
Unauthenticated attackers can predict AJAX actions to retrieve sensitive site configuration data, including plugin lists and hashed security keys.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-38314?
CVE-2021-38314 is a medium-severity vulnerability in Redux.io Gutenberg Template Library & Redux Framework, published on 2 Sep 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Gutenberg Template Library & Redux Framework plugin <= 4.2.11 for WordPress registered several AJAX actions available to unauthenticated users in the `includes` function in `redux-core/class-redux-core.php` that were unique to a given site but deterministic and predictable given that they were based on an md5 hash of the site URL with a known salt value of '-redux' and an md5 hash of the previous hash with a known salt value of '-support'. These AJAX actions could be used to retrieve a list of active plugins and their versions, the site's PHP version, and an unsalted md5 hash of site’s `AUTH_KEY` concatenated with the `SECURE_AUTH_KEY`.
Which versions are affected by CVE-2021-38314?
It affects 1 product.
Products include Redux Gutenberg Template Library \& Redux Framework.
How do I fix CVE-2021-38314?
No fix has been published for CVE-2021-38314 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-38314 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-38314 exists.
Public exploit code: 1 Nuclei template and 7 proofs of concept on GitHub.
Other vulnerabilities in Redux.io Gutenberg Template Library & Redux Framework
Sources
Also known as GHSA-h223-3fmj-vhg5.