CVE-2024-13907

Executive Summary

CVE-2024-13907 is a Server-Side Request Forgery (SSRF) vulnerability in the Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress. This flaw affects all versions up to and including 1.16.8. The vulnerability exists within the download function, allowing authenticated attackers with Administrator-level access to make arbitrary web requests from the vulnerable server. This can be abused to probe internal services, exfiltrate data, or potentially modify internal resources. The CVSS score is 4.9 (Medium), and the EPSS score is 0.0%, indicating low exploitation likelihood in the wild. No public proof-of-concept or patch details are currently available.

WordPress Ecosystem Context

This vulnerability is specific to the WordPress plugin ecosystem. The flaw resides in the BoldGrid Total Upkeep plugin, not in the WordPress core or any web server software. Administrators should prioritize updating the plugin once a patch is released.

CVSS Breakdown & Threat Level

• CVSS Score: 4.9 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High (Administrator)
• User Interaction: None
• Scope: Changed (impact on resources beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the requirement for Administrator-level access reduces the immediate risk. However, if an attacker gains admin credentials (e.g., via phishing or other vulnerabilities), they can leverage this SSRF to pivot into internal networks.

Deep Dive & Mechanics

The vulnerability is a classic Server-Side Request Forgery (SSRF) in the download function of the Total Upkeep plugin. The function likely accepts a URL parameter and fetches content from that URL without proper validation or restriction. An authenticated administrator can craft a request to the plugin's download endpoint, specifying an internal IP address (e.g., http://169.254.169.254/latest/meta-data/) or other internal services.

Attack Flow:

1. Attacker authenticates as an administrator.
2. Attacker sends a POST/GET request to the vulnerable endpoint (e.g., /wp-admin/admin-ajax.php?action=totalupkeep_download&url=http://internal-service/).
3. The plugin's download function uses wp_remote_get() or similar to fetch the URL.
4. The server makes a request to the internal service, potentially leaking sensitive data or allowing modification of internal resources.

Impact:

• Information Disclosure: Access to cloud metadata (AWS, GCP, Azure), internal APIs, or databases.
• Internal Port Scanning: Determine which internal services are running.
• Modification of Internal Services: If the internal service accepts write operations (e.g., internal configuration endpoints), the attacker could modify data.

Vulnerable vs. Patched Code

Since no patch is available, we can only infer the vulnerable code pattern. The vulnerable function likely looks like:

// Vulnerable code (hypothetical)
function totalupkeep_download() {
    $url = $_REQUEST['url'];
    $response = wp_remote_get($url);
    // Process response...
}

A patched version would include:

• URL validation (allowlist of allowed domains/IPs)
• Blocking private IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8, 169.254.0.0/16)
• Using a nonce or capability check to ensure only authorized actions are performed.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress admin credentials.
• Vulnerable Total Upkeep plugin (<=1.16.8).

Exploitation Steps:

1. Log in to WordPress as an administrator.
2. Identify the AJAX action for the download function (likely totalupkeep_download).
3. Craft a request to fetch internal metadata:

curl -X POST 'http://target.com/wp-admin/admin-ajax.php' \
  --data 'action=totalupkeep_download&url=http://169.254.169.254/latest/meta-data/'

4. Observe the response for leaked data.

Lab Setup:

• Use a local WordPress instance with the vulnerable plugin.
• Set up a simple internal service (e.g., a Python HTTP server on a private IP) to simulate internal resources.

Blue Team (Detection & Response)

Detection:

• Monitor for unusual outbound HTTP requests from the WordPress server to private IP ranges.
• Alert on admin users making requests to the totalupkeep_download AJAX action with suspicious URLs.

Response:

• Immediately revoke admin credentials if suspicious activity is detected.
• Isolate the WordPress server from internal networks.
• Apply virtual patching via WAF rules (see Detection Engineering).

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests from the WordPress server to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8, 169.254.0.0/16).
  • Requests to cloud metadata endpoints (e.g., 169.254.169.254).
• File IOCs:
  • Log entries in WordPress debug log showing totalupkeep_download action with suspicious URLs.
• User Behavior:
  • Administrator accounts making unusual AJAX requests to the plugin.

Detection Engineering

YARA Rule

rule CVE_2024_13907_SSRF_TotalUpkeep {
    meta:
        description = "Detects SSRF attempts via Total Upkeep plugin download function"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-13907"
    strings:
        $ajax_action = "totalupkeep_download"
        $url_param = "url="
        $private_ip = /(10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2[0-9]|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|127\.\d{1,3}\.\d{1,3}\.\d{1,3}|169\.254\.\d{1,3}\.\d{1,3})/
    condition:
        $ajax_action and $url_param and $private_ip
}

Sigma Rule

title: CVE-2024-13907 SSRF via Total Upkeep Plugin
id: 8a3b2c1d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects SSRF attempts via Total Upkeep plugin download function
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=totalupkeep_download'
        cs-uri-query|contains: 'url='
        cs-uri-query|re: '(10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2[0-9]|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|127\.\d{1,3}\.\d{1,3}\.\d{1,3}|169\.254\.\d{1,3}\.\d{1,3})'
    condition: selection
falsepositives:
    - Legitimate admin use of plugin to download from internal resources (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-13907 SSRF via Total Upkeep Plugin";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"action=totalupkeep_download";
    http_client_body;
    content:"url=";
    http_client_body;
    pcre:"/(10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2[0-9]|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|127\.\d{1,3}\.\d{1,3}\.\d{1,3}|169\.254\.\d{1,3}\.\d{1,3})/R";
    sid:10000001;
    rev:1;
    reference:cve,2024-13907;
)

Remediation & Mitigation

Immediate Actions:

1. Update Plugin: Monitor the BoldGrid plugin repository for a patched version. As of now, no patch is available.
2. Restrict Admin Access: Limit the number of users with Administrator-level access.
3. Network Segmentation: Isolate the WordPress server from sensitive internal networks.
4. Web Application Firewall (WAF): Deploy rules to block requests to private IP ranges via the plugin's download function.

Long-Term Fix:

• Apply the vendor patch once released.
• Implement input validation and allowlisting for URLs in the plugin code.
• Use a nonce or capability check to ensure only authorized actions are performed.

Workaround:

• Disable the Total Upkeep plugin if not essential, or remove admin privileges from non-essential users.

Valters IT