Improper Certificate Validation Affecting wp-cli/wp-cli package, versions <2.5.0
Snyk CVSS
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PHP-WPCLIWPCLI-1295714
- published 20 May 2021
- disclosed 19 May 2021
- credit @WhiteWinterWolf
Introduced: 19 May 2021
CVE-2021-29504 Open this link in a new tabHow to fix?
Upgrade wp-cli/wp-cli to version 2.5.0 or higher.
Overview
wp-cli/wp-cli is a WP-CLI framework.
Affected versions of this package are vulnerable to Improper Certificate Validation. The default behaviour of WP_CLI\Utils\http_request() when encountering a TLS handshake error is to disable certificate validation and retry the same request. This allows remote attackers who are able to intercept the communication to remotely disable the certificate verification on the WP-CLI side, gaining full control over the communication content, including the ability to impersonate update servers and push malicious updates towards WordPress instances controlled by the vulnerable WP-CLI agent, or push malicious updates toward WP-CLI itself.