CVE-2018-19370

Yoast SEO <= 9.1.0 - Race Condition to Remote Code Execution

2018-11-06 00:00

Strategic Overview

Status: Patched in 9.2.0
Affected Plugin: Yoast SEO – Advanced SEO with real-time guidance and built-in AI
Affected Version: <= 9.1.0
CVSS: 6.6Medium
Weakness type: CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVE: CVE-2018-19370

View all Yoast SEO – Advanced SEO with real-time guidance and built-in AI vulnerabilities

At a glance

CVE-2018-19370 is a medium-severity Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in the Yoast SEO WordPress plugin, affecting versions <= 9.1.0. It carries a CVSS score of 6.6 (reachable over the network; high confidentiality, integrity, availability impact). The issue is fixed in version 9.2.0; sites on affected versions should update now. Disclosed November 2018.

Vulnerability Overview

A Race condition vulnerability in unzip_file in admin/import/class-import-settings.php in the Yoast SEO (wordpress-seo) plugin before 9.2.0 for WordPress allows an SEO Manager to perform command execution on the Operating System via a ZIP import.

Technical Analysis

The vector marks this flaw as remotely reachable over the network, and no interaction from a victim user. A successful exploit has high impact on confidentiality, integrity, availability — full site compromise territory.

CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Remediation

Update to version 9.2.0, or a newer patched version

How does WordSec protect against this?

The fix is the thing that ends this: Yoast SEO 9.2.0 closes this, and updating the plugin is the step that ends it.

Alerts

External References

https://www.cve.org/CVERecord?id=CVE-2018-19370 https://www.wordfence.com/threat-intel/vulnerabilities/id/e8b62157-8c32-462f-aba7-dab137f98f32 https://nvd.nist.gov/vuln/detail/CVE-2018-19370

Related records

Other vulnerabilities in Yoast SEO – Advanced SEO with real-time guidance and built-in AI

CVSS Vector

6.6

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Base

Attack VectorNetwork
Attack ComplexityHigh
Privileges RequiredHigh
User InteractionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh

This record contains material that is subject to copyright

CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

https://www.cve.org/Legal/TermsOfUse

Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.

https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/