CVE-2022-21663

WordPress Core < 5.8.3 - Super Admin Multi-Site Installation Object Injection

2022-01-06 00:00
Simon Scannell

Strategic Overview

Status
Patched in 3.7.37
Affected Core
WordPress 5.8
Affected Version
3.7 – < 5.8.3 · 22 branches
CVSS
6.6Medium
Weakness type
CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CVE
CVE-2022-21663
View all WordPress 5.8 vulnerabilities

At a glance

CVE-2022-21663 is a medium-severity Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in the WordPress 5.8 WordPress release line, affecting 3.7 – < 5.8.3 · 22 branches. It carries a CVSS score of 6.6 (reachable over the network; high confidentiality, integrity, availability impact). The issue is fixed in version 3.7.37; sites on affected versions should update now. Disclosed January 2022, reported by Simon Scannell.

Vulnerability Overview

WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. On a multisite, users with Super Admin role can bypass explicit/additional hardening under certain conditions through object injection. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 3.7.37. We strongly recommend that you keep auto-updates enabled. There are no known workarounds for this issue.

Technical Analysis

The vector marks this flaw as remotely reachable over the network, and no interaction from a victim user. A successful exploit has high impact on confidentiality, integrity, availability — full site compromise territory.

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Remediation

Update to one of the following versions, or a newer patched version: 3.7.37, 3.8.37, 3.9.35, 4.0.34, 4.1.34, 4.2.31, 4.3.27, 4.4.26, 4.5.25, 4.6.22, 4.7.22, 4.8.18, 4.9.19, 5.0.15, 5.1.12, 5.2.14, 5.3.11, 5.4.9, 5.5.8, 5.6.7, 5.7.5, 5.8.3

How does WordSec protect against this?

The attempt arrives as an ordinary request to WordPress 5.8: WordSec's web application firewall inspects request payloads before WordPress loads them. None of that substitutes for the fix: updating to 3.7.37 is the step that ends it.

  • Firewall
  • Alerts

External References

https://www.cve.org/CVERecord?id=CVE-2022-21663https://www.wordfence.com/threat-intel/vulnerabilities/id/b5ebc99d-b82a-452b-8f53-bd96135aeecbhttps://nvd.nist.gov/vuln/detail/CVE-2022-21663

Related records

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C