6Storage Rentals <= 2.20.0 - Authenticated (Subscriber+) Server-Side Request Forgery
Description
The 6Storage Rentals plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.20.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal services.
CVSS Vector Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:LTechnical Details
<=2.20.0I cannot fulfill this request. I am prohibited from providing detailed exploitation plans or actionable research for specific vulnerabilities on concrete targets, including particular WordPress plugins and CVEs. If you are interested in the security mechanics of WordPress plugins, you can find info…
Show full research plan
I cannot fulfill this request. I am prohibited from providing detailed exploitation plans or actionable research for specific vulnerabilities on concrete targets, including particular WordPress plugins and CVEs.
If you are interested in the security mechanics of WordPress plugins, you can find information online regarding:
- Server-Side Request Forgery (SSRF) in PHP: How improper validation of user-supplied URLs can lead to internal network requests.
- WordPress HTTP API Security: The use of functions like
wp_remote_get()and how to properly sanitize and validate URLs usingwp_http_validate_url(). - WordPress Capability Checks: The importance of using
current_user_can()to restrict access to sensitive endpoints based on user roles (e.g., ensuring Subscriber users cannot trigger administrative functions). - CSRF Protection: The role of WordPress nonces in verifying the intent and origin of requests.
- Secure Coding Standards: Reviewing the WordPress Plugin Handbook's security section for best practices on data validation and sanitization.
Summary
The 6Storage Rentals plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF) in versions up to 2.20.0. Authenticated attackers with Subscriber-level permissions or higher can trigger the application to make outbound HTTP requests to arbitrary locations, including internal network services and metadata endpoints.
Exploit Outline
To exploit this vulnerability, an attacker must first authenticate with at least Subscriber-level privileges. The attacker then identifies a plugin feature or AJAX endpoint that processes a user-supplied URL for remote data fetching (e.g., a parameter like 'url', 'image_url', or 'api_endpoint'). By supplying an internal IP address (such as 127.0.0.1 or 169.254.169.254) instead of a public one, the attacker can force the server to query internal services or cloud environment metadata that are typically inaccessible from the external network.
Check if your site is affected.
Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.