SB2021122301 - Multiple vulnerabilities in All in One SEO plugin for WordPress

Security Bulletin ID SB2021122301

Severity

High

Patch available

YES

Number of vulnerabilities 2

Exploitation vector Remote access

Highest impact Data manipulation

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Improper access control (CVE-ID: N/A)

The vulnerability allows a remote user to escalate privileges within the application.

The vulnerability exists due to a logic error that allowed using case-sensitive URLs in REST API calls. A remote low-privileged user (e.g. with subscriber privilege) can request any protected REST API endpoint by changing a single character to uppercase in the URL.

2) SQL injection (CVE-ID: N/A)

The vulnerability allows a remote user to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data in the "/wp-json/aioseo/v1/objects" REST API. A remote user can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.

Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.

Remediation

Install update from vendor's website.

References

https://jetpack.com/2021/12/14/severe-vulnerabilities-fixed-in-all-in-one-seo-plugin-version-4-1-5-3/