CVE-2024-13838

Executive Summary

CVE-2024-13838 is a Server-Side Request Forgery (SSRF) vulnerability discovered in the Uncanny Automator plugin for WordPress, affecting all versions up to and including 6.2. The flaw resides in the call_webhook method of the Automator_Send_Webhook class, allowing authenticated attackers with Administrator-level access to make arbitrary web requests from the vulnerable server. This can be leveraged to probe internal network services, exfiltrate sensitive data, or modify internal resources. The vulnerability is classified as a WordPress ecosystem issue and requires high privileges to exploit, but the impact on internal infrastructure can be severe.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. No supply chain compromise has been identified, but the plugin’s widespread use in automation workflows increases the risk of lateral movement within compromised environments.

CVSS Breakdown & Threat Level

• CVSS Score: 5.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High (Administrator)
• User Interaction: None
• Scope: Changed (impact on internal resources)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the SSRF nature can lead to significant internal reconnaissance and potential lateral movement.

Deep Dive & Mechanics

The vulnerability exists in the Automator_Send_Webhook class, specifically in the call_webhook method. This method is designed to send HTTP requests to external webhooks based on automation triggers. However, due to insufficient validation of the target URL, an attacker with Administrator access can manipulate the request to target internal IP addresses (e.g., http://169.254.169.254/, http://localhost/, or internal services).

Root Cause: The plugin does not properly sanitize or restrict the URL parameter passed to the call_webhook method, allowing arbitrary destinations. The request is made from the server’s context, bypassing network segmentation.

Attack Flow:

1. Attacker authenticates as an Administrator.
2. Attacker crafts a malicious automation trigger that calls the call_webhook method with an internal URL.
3. The server executes the request, potentially accessing cloud metadata endpoints, internal APIs, or other services.
4. Attacker can read responses or modify internal resources if the target service allows write operations.

Vulnerable vs. Patched Code

Vulnerable Code (<= 6.2):

class Automator_Send_Webhook {
    public function call_webhook($url, $data) {
        // No validation of $url
        $response = wp_remote_post($url, array('body' => $data));
        return $response;
    }
}

Patched Code (Hypothetical):

class Automator_Send_Webhook {
    public function call_webhook($url, $data) {
        // Validate URL against allowed domains
        $parsed_url = parse_url($url);
        if (!in_array($parsed_url['host'], $this->allowed_domains)) {
            return new WP_Error('invalid_url', 'URL not allowed');
        }
        // Ensure no internal IPs
        if (filter_var($parsed_url['host'], FILTER_VALIDATE_IP) && !filter_var($parsed_url['host'], FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE)) {
            return new WP_Error('internal_ip', 'Internal IPs not allowed');
        }
        $response = wp_remote_post($url, array('body' => $data));
        return $response;
    }
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with Uncanny Automator plugin <= 6.2.
• Administrator credentials.

Exploitation Steps:

1. Log in as Administrator.
2. Navigate to Uncanny Automator → Add New Recipe.
3. Create a trigger (e.g., "User visits a page").
4. Add an action: "Send a webhook".
5. In the webhook URL field, enter an internal target, e.g., http://169.254.169.254/latest/meta-data/.
6. Save and run the recipe.
7. Observe the response (if any) in the recipe logs.

Example Payload:

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: target-wordpress.com
Content-Type: application/x-www-form-urlencoded

action=uncanny_automator_webhook&url=http://169.254.169.254/latest/meta-data/&data=test

Blue Team

Detection:

• Monitor for outbound HTTP requests to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16).
• Alert on Administrator accounts creating new webhook actions targeting unusual URLs.
• Review Uncanny Automator recipe logs for unexpected webhook calls.

Hunting:

• Search for call_webhook calls in PHP error logs.
• Analyze network traffic from WordPress server to internal IPs.

Indicators of Compromise (IOCs)

• Network:
  • Outbound HTTP requests to internal IPs (e.g., 10.x.x.x, 172.16.x.x, 192.168.x.x, 169.254.x.x).
  • Requests to cloud metadata endpoints (e.g., http://169.254.169.254/).
• File:
  • Modified or new Uncanny Automator recipes with suspicious webhook URLs.
• Log:
  • wp_remote_post calls to non-standard destinations in debug logs.

Detection Engineering

YARA Rule

rule Detect_Uncanny_Automator_SSRF {
    meta:
        description = "Detects SSRF exploitation attempts in Uncanny Automator plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-13838"
    strings:
        $s1 = "call_webhook" ascii wide nocase
        $s2 = "wp_remote_post" ascii wide nocase
        $s3 = "169.254.169.254" ascii wide nocase
        $s4 = "localhost" ascii wide nocase
        $s5 = "10." ascii wide nocase
        $s6 = "192.168." ascii wide nocase
    condition:
        all of ($s1, $s2) and any of ($s3, $s4, $s5, $s6)
}

Sigma Rule

title: Uncanny Automator SSRF Exploitation
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SSRF attempts via Uncanny Automator webhook calls to internal IPs
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=uncanny_automator_webhook'
        cs-uri-query|contains: 
            - 'url=http://10.'
            - 'url=http://172.16.'
            - 'url=http://192.168.'
            - 'url=http://169.254.'
            - 'url=http://localhost'
    condition: selection
falsepositives:
    - Legitimate internal webhook usage (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-13838 Uncanny Automator SSRF Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"action=uncanny_automator_webhook"; http_client_body;
    pcre:"/url=http:\/\/(10\.|172\.1[6-9]\.|172\.2[0-9]\.|172\.3[0-1]\.|192\.168\.|169\.254\.|localhost)/Ri";
    classtype:attempted-recon;
    sid:10000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not essential until a patch is released.
2. Restrict Administrator access to only trusted users.
3. Implement network segmentation to prevent WordPress server from accessing internal services.

Long-term Fix:

• Apply vendor patch when available (currently UNKNOWN).
• Implement URL validation in custom code or via WAF rules.

Workarounds:

• Use a Web Application Firewall (WAF) to block requests containing internal IP patterns.
• Monitor and audit all Administrator actions in WordPress.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert