CVE-2024-1855

Executive Summary

CVE-2024-1855 is a Server-Side Request Forgery (SSRF) vulnerability discovered in the WPCafe – Restaurant Menu, Online Ordering for WooCommerce, Pickup / Delivery and Table Reservation WordPress plugin. This flaw affects all versions up to and including 2.2.23. The vulnerability resides in the wpc_check_for_submission function, which fails to properly validate user-supplied URLs before making outbound HTTP requests. An unauthenticated attacker can exploit this to force the web server to send crafted requests to arbitrary internal or external hosts, potentially leading to information disclosure, internal network scanning, or further attacks against backend services.

As a WordPress plugin vulnerability, this issue is part of the broader WordPress ecosystem threat landscape. The plugin is widely used by restaurants and food service businesses for online ordering and table management, making it a high-value target for attackers seeking to pivot into internal networks or exfiltrate sensitive data.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress Plugin Directory and is not managed through NPM, PyPI, Go, or Ruby package managers. However, the risk extends to any site using the plugin, as the SSRF can be used to probe internal services (e.g., Redis, Memcached, cloud metadata endpoints) or perform port scanning. Organizations should treat this as a critical supply chain risk for their WordPress deployments.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: None
• Availability Impact: None

Threat Level: Medium. While the direct impact is limited to information disclosure, the SSRF can be chained with other vulnerabilities (e.g., internal service exploitation) to escalate privileges or cause lateral movement.

Deep Dive & Mechanics

The vulnerability is located in the wpc_check_for_submission function, which is part of the WPCafe plugin's order submission handling. This function is designed to validate and process incoming order data, but it includes a feature that makes outbound HTTP requests to URLs provided by the user (e.g., for webhook callbacks or external validation). The code does not sanitize or restrict the target URL, allowing an attacker to specify arbitrary destinations.

Root Cause: The function uses wp_remote_get() or similar WordPress HTTP API calls with user-controlled input without proper validation. Specifically, the $url parameter is passed directly to the HTTP request function without checking:

• Whether the URL points to an internal IP (e.g., 127.0.0.1, 10.x.x.x, 192.168.x.x).
• Whether the URL uses a disallowed scheme (e.g., file://, gopher://).
• Whether the URL is a valid external endpoint.

Attack Flow:

1. An unauthenticated attacker sends a POST request to the vulnerable endpoint (e.g., /wp-admin/admin-ajax.php with action wpc_check_for_submission).
2. The attacker includes a crafted url parameter pointing to an internal service (e.g., http://169.254.169.254/latest/meta-data/ for AWS metadata).
3. The server makes the request and returns the response to the attacker, leaking sensitive information.

Vulnerable vs. Patched Code

Since no official patch has been released, the vulnerable code remains in all versions <= 2.2.23. The following is a hypothetical example of the vulnerable code and a suggested fix.

Vulnerable Code (wpcafe/includes/class-wpc-order.php):

public function wpc_check_for_submission() {
    $url = $_POST['url']; // No validation
    $response = wp_remote_get( $url );
    // Process response...
}

Patched Code (Suggested Fix):

public function wpc_check_for_submission() {
    $url = esc_url_raw( $_POST['url'] );
    if ( ! wp_http_validate_url( $url ) ) {
        wp_die( 'Invalid URL' );
    }
    $parsed = parse_url( $url );
    if ( filter_var( $parsed['host'], FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE ) ) {
        wp_die( 'Internal IP not allowed' );
    }
    $response = wp_remote_get( $url, array( 'timeout' => 5 ) );
    // Process response...
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with WPCafe plugin version <= 2.2.23.
• Network access to the target server.

Exploitation Steps:

1. Identify the vulnerable endpoint: /wp-admin/admin-ajax.php with action wpc_check_for_submission.
2. Craft a POST request with a malicious URL:

   curl -X POST http://target.com/wp-admin/admin-ajax.php \
     -d "action=wpc_check_for_submission&url=http://169.254.169.254/latest/meta-data/"
   

3. The server will fetch the AWS metadata and return it in the response.

Advanced Exploitation:

• Use gopher:// or file:// schemes if not blocked (though WordPress typically blocks these).
• Chain with internal service exploitation (e.g., Redis, Memcached) by sending crafted payloads.

Blue Team (Detection & Hardening)

Detection:

• Monitor for POST requests to /wp-admin/admin-ajax.php with action=wpc_check_for_submission and suspicious url parameters.
• Look for outbound HTTP requests from the web server to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8).

Hardening:

• Disable the plugin until a patch is available.
• Implement a Web Application Firewall (WAF) rule to block requests containing internal IPs in the url parameter.
• Restrict outbound traffic from the web server using network ACLs or iptables.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound HTTP requests to internal IP addresses (e.g., 10.x.x.x, 192.168.x.x, 127.0.0.1).
  • Requests to cloud metadata endpoints (e.g., 169.254.169.254).
  • Unusual User-Agent strings in outbound requests (default WordPress HTTP API).

• File IOCs:

  • Modified wpcafe/includes/class-wpc-order.php file (if attacker attempts to patch).
  • Suspicious log entries in WordPress debug log (wp-content/debug.log).

• Log IOCs:

  • Repeated POST requests to /wp-admin/admin-ajax.php with action=wpc_check_for_submission.
  • Error logs showing failed connections to internal IPs.

Detection Engineering

YARA Rule

rule CVE_2024_1855_SSRF_WPCafe {
    meta:
        description = "Detects exploitation attempts of CVE-2024-1855 SSRF in WPCafe plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-1855"
    strings:
        $ajax_action = "wpc_check_for_submission"
        $internal_ip = /(127\.0\.0\.1|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3})/
        $metadata = "169.254.169.254"
    condition:
        $ajax_action and ($internal_ip or $metadata)
}

Sigma Rule

title: CVE-2024-1855 WPCafe SSRF Exploitation Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects POST requests to wpc_check_for_submission with internal IPs or cloud metadata endpoints
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=wpc_check_for_submission'
    internal_ip:
        cs-uri-query|contains:
            - '127.0.0.1'
            - '10.'
            - '192.168.'
            - '172.16.'
            - '172.17.'
            - '172.18.'
            - '172.19.'
            - '172.20.'
            - '172.21.'
            - '172.22.'
            - '172.23.'
            - '172.24.'
            - '172.25.'
            - '172.26.'
            - '172.27.'
            - '172.28.'
            - '172.29.'
            - '172.30.'
            - '172.31.'
            - '169.254.169.254'
    condition: selection and internal_ip
falsepositives:
    - Legitimate use of internal services (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-1855 WPCafe SSRF Exploitation Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=wpc_check_for_submission"; http_client_body;
    pcre:"/(127\.0\.0\.1|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|169\.254\.169\.254)/Ri";
    sid:1000001;
    rev:1;
    reference:cve,2024-1855;
    classtype:attempted-recon;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the WPCafe plugin until a patched version is released.
2. Apply virtual patching via WAF to block requests containing internal IPs in the url parameter.
3. Restrict outbound traffic from the web server using firewall rules (e.g., allow only necessary external IPs).

Long-term Fix:

• The vendor must release a patched version that validates URLs against internal IP ranges and disallows dangerous schemes.
• Implement input validation using wp_http_validate_url() and filter_var() with FILTER_FLAG_NO_PRIV_RANGE.

Workaround:

• If the plugin cannot be disabled, modify the vulnerable function manually (see patched code example) or use a WordPress security plugin that blocks SSRF attempts.

Valters IT