CVE - CVE-2021-29504

CVE-ID
CVE-2021-29504	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
WP-CLI is the command-line interface for WordPress. An improper error handling in HTTPS requests management in WP-CLI version 0.12.0 and later allows remote attackers able to intercept the communication to remotely disable the certificate verification on WP-CLI side, gaining full control over the communication content, including the ability to impersonate update servers and push malicious updates towards WordPress instances controlled by the vulnerable WP-CLI agent, or push malicious updates toward WP-CLI itself. The vulnerability stems from the fact that the default behavior of `WP_CLI\Utils\http_request()` when encountering a TLS handshake error is to disable certificate validation and retry the same request. The default behavior has been changed with version 2.5.0 of WP-CLI and the `wp-cli/wp-cli` framework (via https://github.com/wp-cli/wp-cli/pull/5523) so that the `WP_CLI\Utils\http_request()` method accepts an `$insecure` option that is `false` by default and consequently that a TLS handshake failure is a hard error by default. This new default is a breaking change and ripples through to all consumers of `WP_CLI\Utils\http_request()`, including those in separate WP-CLI bundled or third-party packages. https://github.com/wp-cli/wp-cli/pull/5523 has also added an `--insecure` flag to the `cli update` command to counter this breaking change. There is no direct workaround for the default insecure behavior of `wp-cli/wp-cli` versions before 2.5.0. The workaround for dealing with the breaking change in the commands directly affected by the new secure default behavior is to add the `--insecure` flag to manually opt-in to the previous insecure behavior.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
CONFIRM:https://github.com/wp-cli/wp-cli/security/advisories/GHSA-rwgm-f83r-v3qj URL:https://github.com/wp-cli/wp-cli/security/advisories/GHSA-rwgm-f83r-v3qj MISC:https://github.com/wp-cli/checksum-command/pull/86 URL:https://github.com/wp-cli/checksum-command/pull/86 MISC:https://github.com/wp-cli/config-command/pull/128 URL:https://github.com/wp-cli/config-command/pull/128 MISC:https://github.com/wp-cli/core-command/pull/186 URL:https://github.com/wp-cli/core-command/pull/186 MISC:https://github.com/wp-cli/extension-command/pull/287 URL:https://github.com/wp-cli/extension-command/pull/287 MISC:https://github.com/wp-cli/package-command/pull/138 URL:https://github.com/wp-cli/package-command/pull/138 MISC:https://github.com/wp-cli/wp-cli/pull/5523 URL:https://github.com/wp-cli/wp-cli/pull/5523
Assigning CNA
GitHub (maintainer security advisories)
Date Record Created
20210330	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20210330)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)