CVE-2021-29504
WordPress WP-CLI HTTPS Certificate Verification Bypass
Description
WP-CLI is the command-line interface for WordPress. An improper error handling in HTTPS requests management in WP-CLI version 0.12.0 and later allows remote attackers able to intercept the communication to remotely disable the certificate verification on WP-CLI side, gaining full control over the communication content, including the ability to impersonate update servers and push malicious updates towards WordPress instances controlled by the vulnerable WP-CLI agent, or push malicious updates toward WP-CLI itself. The vulnerability stems from the fact that the default behavior of `WP_CLI\Utils\http_request()` when encountering a TLS handshake error is to disable certificate validation and retry the same request. The default behavior has been changed with version 2.5.0 of WP-CLI and the `wp-cli/wp-cli` framework (via https://github.com/wp-cli/wp-cli/pull/5523) so that the `WP_CLI\Utils\http_request()` method accepts an `$insecure` option that is `false` by default and consequently that a TLS handshake failure is a hard error by default. This new default is a breaking change and ripples through to all consumers of `WP_CLI\Utils\http_request()`, including those in separate WP-CLI bundled or third-party packages. https://github.com/wp-cli/wp-cli/pull/5523 has also added an `--insecure` flag to the `cli update` command to counter this breaking change. There is no direct workaround for the default insecure behavior of `wp-cli/wp-cli` versions before 2.5.0. The workaround for dealing with the breaking change in the commands directly affected by the new secure default behavior is to add the `--insecure` flag to manually opt-in to the previous insecure behavior.
INFO
Published Date :
June 7, 2021, 9:15 p.m.
Last Modified :
June 17, 2021, 3:33 p.m.
Source :
[email protected]
Remotely Exploitable :
Yes !
Impact Score :
5.2
Exploitability Score :
3.9
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2021-29504
.
URL | Resource |
---|---|
https://github.com/wp-cli/checksum-command/pull/86 | Patch Third Party Advisory |
https://github.com/wp-cli/config-command/pull/128 | Patch Third Party Advisory |
https://github.com/wp-cli/core-command/pull/186 | Patch Third Party Advisory |
https://github.com/wp-cli/extension-command/pull/287 | Patch Third Party Advisory |
https://github.com/wp-cli/package-command/pull/138 | Third Party Advisory |
https://github.com/wp-cli/wp-cli/pull/5523 | Patch Third Party Advisory |
https://github.com/wp-cli/wp-cli/security/advisories/GHSA-rwgm-f83r-v3qj | Third Party Advisory |
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2021-29504
vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2021-29504
vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by [email protected]
May. 14, 2024
Action Type Old Value New Value -
Initial Analysis by [email protected]
Jun. 17, 2021
Action Type Old Value New Value Added CVSS V2 NIST (AV:N/AC:L/Au:N/C:P/I:P/A:P) Added CVSS V3.1 NIST AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Changed Reference Type https://github.com/wp-cli/checksum-command/pull/86 No Types Assigned https://github.com/wp-cli/checksum-command/pull/86 Patch, Third Party Advisory Changed Reference Type https://github.com/wp-cli/config-command/pull/128 No Types Assigned https://github.com/wp-cli/config-command/pull/128 Patch, Third Party Advisory Changed Reference Type https://github.com/wp-cli/core-command/pull/186 No Types Assigned https://github.com/wp-cli/core-command/pull/186 Patch, Third Party Advisory Changed Reference Type https://github.com/wp-cli/extension-command/pull/287 No Types Assigned https://github.com/wp-cli/extension-command/pull/287 Patch, Third Party Advisory Changed Reference Type https://github.com/wp-cli/package-command/pull/138 No Types Assigned https://github.com/wp-cli/package-command/pull/138 Third Party Advisory Changed Reference Type https://github.com/wp-cli/wp-cli/pull/5523 No Types Assigned https://github.com/wp-cli/wp-cli/pull/5523 Patch, Third Party Advisory Changed Reference Type https://github.com/wp-cli/wp-cli/security/advisories/GHSA-rwgm-f83r-v3qj No Types Assigned https://github.com/wp-cli/wp-cli/security/advisories/GHSA-rwgm-f83r-v3qj Third Party Advisory Added CPE Configuration OR *cpe:2.3:a:wp-cli:wp-cli:*:*:*:*:*:*:*:* versions from (including) 0.12.0 up to (excluding) 2.5.0
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2021-29504
is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2021-29504
weaknesses.
Exploit Prediction
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days.
0.33 }} 0.10%
score
0.71447
percentile