パッチ未適用の WordPress SSRF 脆弱性調査における隠れた危険性の発見

Introduction – Exploring the Unknown: Beneath the Surface of Unpatched WordPress SSRF

In the ever-evolving landscape of cybersecurity, WordPress remains a popular target due to its widespread usage and extensive plugin ecosystem. While the WordPress core is generally secure, vulnerabilities often arise from third-party plugins and themes. One such vulnerability that has garnered attention is the Server-Side Request Forgery (SSRF) vulnerability. In this blog post, we will delve into the intricacies of the unpatched WordPress SSRF vulnerability, its implications, and how WP-Firewall can help protect your WordPress site from such threats.

## The Root Cause: wp_http_validate_url()

In September 2022, SonarSource published an advisory on an unpatched WordPress Core Unauthenticated Blind SSRF. The root cause of this vulnerability lies in the `wp_http_validate_url()` function, which is susceptible to DNS rebinding attacks. While the WordPress core itself is not directly affected, plugins that utilize this vulnerable function are at risk.

Understanding wp_http_validate_url()

The `wp_http_validate_url()` function is designed to validate URLs to prevent redirection and request forgery attacks. However, it falls short in protecting against DNS rebinding attacks, making it a potential vector for SSRF vulnerabilities. This function is often used in conjunction with `wp_remote_get()` and its safer alternative, `wp_safe_remote_get()`.

The Obvious Part: wp_remote_get() and wp_safe_remote_get()

The `wp_remote_get()` function is commonly used to request remote hosts through the server. However, it is well-known that passing user-input URLs into this function can lead to SSRF vulnerabilities. To mitigate this risk, WordPress introduced `wp_safe_remote_get()`, which includes additional validations to prevent SSRF attacks.

How Safe is wp_safe_remote_get()?

The `wp_safe_remote_get()` function is designed to be a safer alternative to `wp_remote_get()`. According to the official WordPress documentation:

"This function is ideal when the HTTP request is being made to an arbitrary URL. The URL is validated to avoid redirection and request forgery attacks."

However, the function's safety is limited by the underlying `wp_http_validate_url()` function, which, as mentioned earlier, is vulnerable to DNS rebinding attacks.

Diving into the Function

The source code for `wp_safe_remote_get()` is as follows:

php
function wp_safe_remote_get( $url, $args = array() ) {
    $args['reject_unsafe_urls'] = true;
    $http = _wp_http_get_object();
    return $http->get( $url, $args );
}

On line 2, the `$args['reject_unsafe_urls']` parameter is set to `true`, which eventually passes the user input to the `wp_http_validate_url()` function before requesting the URL. Since `wp_http_validate_url()` is vulnerable to DNS rebinding attacks, any function relying solely on it for validation is also vulnerable.

Limitations of the Vulnerability

While this is not a full-fledged SSRF, there are limitations set by the `wp_http_validate_url()` function:

– The protocol must be either `http://` or `https://`
– The port can only be one of 80, 443, or 8080

Despite these limitations, requesting internal hosts within these boundaries is possible through this SSRF.

Vulnerable Plugin Code

Here are some examples of vulnerable plugin code:

Non-blind SSRF

php
<?php
require_once('wp-load.php');
$url = $_GET['url'];
$response = wp_safe_remote_get( $url );
$response = wp_remote_retrieve_body( $response );
echo $response;
?>

If the plugin takes user input, passes it to the `wp_safe_remote_get()` function, and then displays the response, it is vulnerable to non-blind limited SSRF.

Blind SSRF

php
<?php
require_once('wp-load.php');
$url = $_GET['url'];
$response = wp_safe_remote_get( $url );
$response_code = wp_remote_retrieve_response_code( $response );
if ($response_code == 200) {
    echo "Up and running";
} else {
    echo "Down or not found!";
}
?>

If the plugin passes user input to `wp_safe_remote_get()` but only returns the response code/status, it is vulnerable to blind SSRF, limiting the impact to port-scanning of ports 80, 443, or 8080 of any internal host.

Attack Demonstration

To demonstrate this vulnerability, we performed an attack on an Apache server running WordPress on port 80 and a PHP server running on localhost:8080 with some secret information. The vulnerable code was inserted in the plugin directory `/wp-content/plugins/vulnerable-plugin/index.php`.

GitHub Repository

You can find a vulnerable Docker instance and the exploit script to play with on this vulnerability in this GitHub repository. Credit: Ananda Dhakal

## More Vulnerable Functions

The same vulnerability applies to other functions that rely on `wp_http_validate_url()` for validation:

– `wp_safe_remote_request()`
– `wp_safe_remote_post()`
– `wp_safe_remote_head()`

Additionally, some functions act as wrappers for `wp_safe_remote_get()` and are also vulnerable to some extent:

– `WP_REST_URL_Details_Controller::get_remote_url()`
– `download_url()`
– `wp_remote_fopen()`
– `WP_oEmbed::discover()`

結論

It is evident that functions considered safe and designed to protect against SSRF vulnerabilities are not entirely foolproof. The reliance on `wp_http_validate_url()`, which is vulnerable to DNS rebinding attacks, exposes WordPress sites to potential SSRF attacks. We urge the WordPress Core team to address this issue and release a patch to enhance the security of the platform.

WP-Firewallがどのように役立つか

At WP-Firewall, we understand the critical importance of securing your WordPress site against emerging threats. Our comprehensive security solutions are designed to provide robust protection against a wide range of vulnerabilities, including SSRF attacks. Here’s how WP-Firewall can help safeguard your WordPress site:

リアルタイムの脅威検出

WP-Firewall offers real-time threat detection capabilities that monitor your site for suspicious activities and potential vulnerabilities. Our advanced algorithms can identify and block SSRF attempts, ensuring your site remains secure.

定期的なセキュリティ監査

Our team of security experts conducts regular audits of your WordPress site and its plugins to identify and address vulnerabilities. By staying ahead of potential threats, we help you maintain a secure environment for your users.

Automated Patch Management

Keeping your WordPress core, themes, and plugins up-to-date is crucial for security. WP-Firewall provides automated patch management, ensuring that all components of your site are updated with the latest security patches.

Custom Firewall Rules

WP-Firewall allows you to create custom firewall rules tailored to your specific needs. By implementing rules that block malicious requests and unauthorized access attempts, you can enhance the security of your site.

Comprehensive Reporting

Our detailed security reports provide insights into the threats detected and actions taken to protect your site. With WP-Firewall, you can stay informed about the security status of your WordPress site at all times.

Protecting Against SSRF with WP-Firewall

To specifically address SSRF vulnerabilities, WP-Firewall offers the following features:

Input Validation

WP-Firewall performs rigorous input validation to ensure that user-supplied URLs are safe and free from malicious intent. By validating inputs at multiple levels, we prevent SSRF attacks from exploiting vulnerable functions.

DNS Rebinding Protection

Our firewall includes DNS rebinding protection mechanisms that detect and block attempts to exploit DNS rebinding vulnerabilities. This ensures that your site remains secure even if underlying functions like `wp_http_validate_url()` are vulnerable.

Secure API Requests

WP-Firewall secures API requests by enforcing strict validation and authentication measures. This prevents unauthorized access and mitigates the risk of SSRF attacks targeting API endpoints.

Continuous Monitoring

Our continuous monitoring capabilities keep a watchful eye on your site’s traffic and activities. Any suspicious behavior is flagged and addressed promptly, minimizing the risk of successful SSRF attacks.

アクションの呼び出し

While the unpatched WordPress SSRF vulnerability poses a significant risk, proactive measures can mitigate its impact. By leveraging WP-Firewall’s comprehensive security solutions, you can protect your WordPress site from SSRF attacks and other emerging threats. Stay ahead of potential vulnerabilities and ensure a secure environment for your users with WP-Firewall.

Don’t wait for a security breach to take action. Secure your WordPress site today with WP-Firewall. Start your free trial and experience the peace of mind that comes with robust, real-time protection.

For more information on how WP-Firewall can help secure your WordPress site, visit our website or contact our support team.

Stay safe, stay secure, and keep your WordPress site protected with WP-Firewall.

—

Weekly Security Advice

Get the latest WordPress security intelligence delivered to your inbox. ニュースレターを購読する and stay informed about the latest threats and best practices for securing your WordPress site.

The Latest in Security Advisories

See all the latest security advisories and stay updated on critical vulnerabilities affecting WordPress plugins and themes.

– 19 May, 2024: WordPress 脆弱性レポート (2024 年 5 月 6 日から 2024 年 5 月 12 日)
– 15 May, 2024: Uncode Core プラグインの優先度の高い脆弱性を修正