Miggo Logo
Miggo Vulnerability Database
→
CVE-2021-29476

CVE-2021-29476: Insecure Deserialization of untrusted data in rmccue/requests

9.8

CVSS Score
3.1

Basic Information

CVE ID
CVE-2021-29476
GHSA ID
GHSA-52qp-jpq7-6c54
EPSS Score
0.83781%
CWE
CWE-502
Published
4/29/2021
Updated
2/1/2023
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
rmccue/requestscomposer>= 1.6.0, < 1.8.01.8.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from insecure deserialization in the Requests_Utility_FilteredIterator class. The commit add6bedf3a53b647d0ebda2970057912d3cd79d3 in WordPress core explicitly patched this by adding empty __unserialize() and unserialize() methods, and unsetting the 'callback' property in __wakeup(). The original vulnerability allowed attackers to inject serialized objects with malicious callbacks, which would be executed via the current() method during iteration. The CVE references and PHPGGC discussion (issue #52) confirm this class was a key vector for exploitation via phar:// deserialization.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t Uns*ri*liz*tion o* untrust** **t*. ### P*t***s T** issu* **s ***n p*t**** *n* us*rs o* `R*qu*sts` *.*.*, *.*.* *n* *.*.* s*oul* up**t* to v*rsion *.*.*. ### R***r*n**s Pu*li**tions **out t** vuln*r**ility: * *ttps://**nn*witz.ninj*/posts

Reasoning

T** vuln*r**ility st*ms *rom ins**ur* **s*ri*liz*tion in t** R*qu*sts_Utility_*ilt*r**It*r*tor *l*ss. T** *ommit **************************************** in Wor*Pr*ss *or* *xpli*itly p*t**** t*is *y ***in* *mpty __uns*ri*liz*() *n* uns*ri*liz*() m*t*