CVE-2021-24307
📋 TL;DR
This vulnerability allows authenticated WordPress administrators (or users with 'aioseo_tools_settings' privilege) to execute arbitrary code on the server by uploading a malicious .ini backup file. The plugin's insecure deserialization of .ini file values combined with the Monolog library creates a gadget chain for remote code execution. This affects All in One SEO plugin installations before version 4.1.0.2.
💻 Affected Systems
- All in One SEO (AIOSEO) WordPress Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise allowing attacker to execute arbitrary system commands, install malware, exfiltrate data, or pivot to other systems.
Likely Case
Attacker gains shell access to the web server, potentially compromising the entire WordPress installation and associated databases.
If Mitigated
Limited to authenticated admin users only, reducing attack surface but still dangerous if admin credentials are compromised.
🎯 Exploit Status
Exploitation requires admin-level access and knowledge of gadget chain construction using Monolog library.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.1.0.2
Vendor Advisory: https://aioseo.com/changelog/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find 'All in One SEO' and click 'Update Now'. 4. Verify version is 4.1.0.2 or later.
🔧 Temporary Workarounds
Disable Import/Export Feature
allRemove access to the vulnerable import/export functionality by restricting user capabilities.
Add to WordPress theme functions.php or custom plugin: remove_cap('aioseo_tools_settings');
File Upload Restriction
linuxBlock .ini file uploads through web server configuration.
For Apache (.htaccess): <FilesMatch "\.ini$">
Order Allow,Deny
Deny from all
</FilesMatch>
For Nginx: location ~*\.ini$ { deny all; }
🧯 If You Can't Patch
- Restrict admin access to trusted users only with strong authentication
- Implement web application firewall (WAF) rules to block .ini file uploads and suspicious POST requests to AIOSEO endpoints
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > All in One SEO > Version. If version is below 4.1.0.2, system is vulnerable.Check Version:
wp plugin list --name="all-in-one-seo-pack" --field=versionVerify Fix Applied:
Confirm plugin version is 4.1.0.2 or higher in WordPress admin plugins page.📡 Detection & Monitoring
Log Indicators:
- POST requests to /wp-admin/admin.php?page=aioseo-tools with .ini file uploads
- Unusual PHP process execution from web server user
- Monolog library errors or warnings
Network Indicators:
- HTTP POST requests containing serialized data to AIOSEO endpoints
- Unexpected outbound connections from web server
SIEM Query:
source="web_server_logs" AND (uri="/wp-admin/admin.php" AND query="page=aioseo-tools" AND method="POST") AND (user_agent CONTAINS "curl" OR user_agent CONTAINS "wget" OR file_extension=".ini")