CVE-2024-24888

Executive Summary

CVE-2024-24888 is a Server-Side Request Forgery (SSRF) vulnerability in the WordPress plugin Gutenberg Blocks by Kadence Blocks (vendor: StellarWP), affecting versions up to and including 3.2.25. The flaw allows an unauthenticated attacker to make the server send crafted HTTP requests to internal or external resources, potentially leading to information disclosure, internal network scanning, or further exploitation. The CVSS score is 6.4 (Medium), and no public exploit or patch is currently available. This vulnerability is specific to the WordPress ecosystem and does not involve Apache or Nginx directly.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users are advised to monitor for updates from StellarWP and consider disabling the plugin if no patch is available. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
• Base Score: 6.4 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

The threat level is medium due to the potential for internal network reconnaissance and limited data exfiltration, but no direct remote code execution or denial of service.

Deep Dive & Mechanics

The vulnerability resides in the Kadence Blocks plugin's handling of user-supplied URLs or parameters that are used to fetch remote resources (e.g., for dynamic block rendering or API calls). The plugin fails to validate or sanitize the target URL, allowing an attacker to specify arbitrary destinations such as http://169.254.169.254/ (cloud metadata) or internal services. This is a classic SSRF flaw (CWE-918).

Root Cause: The plugin uses wp_remote_get() or similar functions with user-controlled input without proper URL validation or allowlisting.

Attack Scenario: An unauthenticated attacker sends a crafted HTTP request to a vulnerable endpoint (e.g., a REST API or AJAX handler) that triggers a server-side fetch. The server then makes a request to an attacker-controlled or internal address, potentially leaking sensitive data.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code pattern is shown below. A patched version would include URL validation.

Vulnerable Code (PHP):

function kadence_blocks_fetch_url($url) {
    $response = wp_remote_get($url);
    // No validation of $url
    return wp_remote_retrieve_body($response);
}

Patched Code (Hypothetical):

function kadence_blocks_fetch_url($url) {
    $allowed_hosts = array('api.example.com', 'cdn.example.com');
    $parsed_url = parse_url($url);
    if (!in_array($parsed_url['host'], $allowed_hosts)) {
        return new WP_Error('invalid_url', 'URL not allowed');
    }
    $response = wp_remote_get($url);
    return wp_remote_retrieve_body($response);
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites: A WordPress site with Kadence Blocks <= 3.2.25 installed and active.

Step 1: Identify vulnerable endpoint.
The plugin may expose an AJAX action like kadence_blocks_fetch or a REST route. Use a tool like Burp Suite or curl to probe.

Step 2: Craft SSRF payload.
Example request to probe internal metadata:

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded

action=kadence_blocks_fetch&url=http://169.254.169.254/latest/meta-data/

Step 3: Observe response.
If the server returns the metadata, the vulnerability is confirmed.

Step 4: Escalate.
Use the SSRF to scan internal ports or access other internal services (e.g., Redis, MySQL).

Blue Team (Detection & Hardening)

Detection:

• Monitor outbound HTTP requests from the web server to unexpected IPs (especially private ranges like 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, and 169.254.0.0/16).
• Log all AJAX requests to admin-ajax.php and inspect the url parameter.

Hardening:

• Disable the plugin if not essential.
• Use a Web Application Firewall (WAF) to block requests containing private IPs in the url parameter.
• Apply network segmentation to limit outbound traffic from the WordPress server.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound HTTP requests to 169.254.169.254, 127.0.0.1, or internal IP ranges.
  • Unusual url parameters in POST requests to /wp-admin/admin-ajax.php or REST endpoints.

• File IOCs:

  • Modified plugin files (e.g., wp-content/plugins/kadence-blocks/...).
  • Suspicious log entries in wp-content/debug.log.

• Log IOCs:

  • Repeated requests to admin-ajax.php with action=kadence_blocks_fetch or similar.

Detection Engineering

YARA Rule

rule CVE_2024_24888_SSRF {
    meta:
        description = "Detects SSRF attempts targeting Kadence Blocks plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-24888"
    strings:
        $url_param = "url=" nocase
        $ajax_action = "action=kadence_blocks_fetch" nocase
        $private_ip = /(127\.|10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|169\.254\.)/
    condition:
        $url_param and $ajax_action and $private_ip
}

Sigma Rule

title: CVE-2024-24888 SSRF Attempt via Kadence Blocks
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests with private IPs in the url parameter targeting Kadence Blocks
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=kadence_blocks_fetch'
        cs-uri-query|contains: 'url='
    filter:
        cs-uri-query|contains:
            - 'url=http://127.'
            - 'url=http://10.'
            - 'url=http://172.16.'
            - 'url=http://172.17.'
            - 'url=http://172.18.'
            - 'url=http://172.19.'
            - 'url=http://172.20.'
            - 'url=http://172.21.'
            - 'url=http://172.22.'
            - 'url=http://172.23.'
            - 'url=http://172.24.'
            - 'url=http://172.25.'
            - 'url=http://172.26.'
            - 'url=http://172.27.'
            - 'url=http://172.28.'
            - 'url=http://172.29.'
            - 'url=http://172.30.'
            - 'url=http://172.31.'
            - 'url=http://192.168.'
            - 'url=http://169.254.'
    condition: selection and filter
falsepositives:
    - Legitimate use of internal URLs by administrators (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-24888 SSRF Attempt - Kadence Blocks"; flow:to_server,established; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action=kadence_blocks_fetch"; http_client_body; pcre:"/url=http:\/\/(127\.|10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|169\.254\.)/Ri"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if it is not critical for business operations.
2. Apply a virtual patch using a WAF to block requests containing private IPs in the url parameter.
3. Monitor logs for SSRF attempts and block offending IPs.

Long-term Fix:

• Wait for an official patch from StellarWP. Once released, update to the patched version immediately.
• If patching is not possible, consider replacing the plugin with an alternative.

Network Hardening:

• Restrict outbound HTTP traffic from the WordPress server using firewall rules.
• Use a reverse proxy to filter malicious requests.

Valters IT