CVE-2024-41305

Executive Summary

CVE-2024-41305 is a Server-Side Request Forgery (SSRF) vulnerability discovered in WonderCMS v3.4.3. The flaw resides in the Plugins Page, specifically within the pluginThemeUrl parameter. An attacker can inject crafted URLs into this parameter, forcing the application to make arbitrary HTTP requests from the server. This can lead to internal network reconnaissance, access to cloud metadata endpoints (e.g., AWS, GCP), or interaction with other internal services. The vulnerability has a CVSS base score of 5.0 (Medium) due to its low complexity, network-based attack vector, and potential for information disclosure. No official patch has been released by the vendor, making this a high-priority issue for any organization using WonderCMS 3.4.3.

Supply Chain & Package Security

WonderCMS is a flat-file PHP CMS distributed via GitHub and its official website. The vulnerability is in the core application code, not a third-party package. However, administrators should verify the integrity of their WonderCMS installation and monitor for any unofficial patches or forks that may address this issue.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Changed (C) – Impact may extend beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited information disclosure possible.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N Base Score: 5.0 (Medium) Threat Level: Medium – Exploitation is straightforward and can lead to internal network mapping and cloud metadata theft.

Deep Dive & Mechanics

The vulnerability exists in the Plugins Page of WonderCMS, which allows administrators to install or update plugins by providing a URL to a plugin package. The pluginThemeUrl parameter is used to specify the download location. Due to insufficient validation, an attacker can supply a URL pointing to internal resources (e.g., http://169.254.169.254/latest/meta-data/ for AWS) or other arbitrary endpoints.

Root Cause: The application uses file_get_contents() or similar PHP functions to fetch the URL without checking if the target is an internal or private IP address. This allows the server to make requests to any reachable host.

Attack Flow:

1. Attacker identifies a WonderCMS instance (e.g., via Shodan or manual scanning).
2. Attacker navigates to the Plugins Page (requires admin login, but default credentials may be weak).
3. Attacker injects a malicious URL into the pluginThemeUrl parameter.
4. The server fetches the URL, potentially exposing sensitive data or allowing further exploitation.

Impact:

• Internal network scanning (port scanning, service discovery).
• Access to cloud metadata endpoints (IAM credentials, instance data).
• SSRF to internal services (databases, caching servers, etc.).
• Potential for blind SSRF leading to data exfiltration.

Vulnerable vs. Patched Code

Vulnerable Code (WonderCMS v3.4.3):

// In plugins.php or similar file
$pluginThemeUrl = $_POST['pluginThemeUrl'];
$content = file_get_contents($pluginThemeUrl);
// Process the downloaded content

Patched Code (Hypothetical fix):

$pluginThemeUrl = $_POST['pluginThemeUrl'];
// Validate URL scheme and host
$parsedUrl = parse_url($pluginThemeUrl);
if (!in_array($parsedUrl['scheme'], ['http', 'https'])) {
    die('Invalid scheme');
}
$host = gethostbyname($parsedUrl['host']);
if (filter_var($host, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE)) {
    $content = file_get_contents($pluginThemeUrl);
} else {
    die('Blocked internal request');
}

Note: No official patch exists. The above is a recommended mitigation.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to a WonderCMS v3.4.3 admin panel (default credentials: admin:admin).
• A listener or server to capture outbound requests (e.g., Burp Collaborator, webhook.site).

Exploit Steps:

1. Log in to WonderCMS admin panel.
2. Navigate to Plugins page.
3. Intercept the request using Burp Suite or similar proxy.
4. Modify the pluginThemeUrl parameter to point to an internal resource:

   pluginThemeUrl=http://169.254.169.254/latest/meta-data/
   

5. Send the request.
6. Observe the response – if successful, the server will return the cloud metadata.

Example Payloads:

• http://127.0.0.1:8080/admin – Internal service probing.
• http://192.168.1.1 – Router configuration page.
• file:///etc/passwd – Local file inclusion (if supported).

Blue Team (Detection & Hardening)

Detection:

• Monitor outbound HTTP requests from the WonderCMS server to unexpected IPs (especially private ranges).
• Look for pluginThemeUrl parameter in POST requests containing internal IPs or unusual URLs.
• Use WAF rules to block requests to private IP ranges (RFC 1918, RFC 6598, etc.).

Hardening:

• Restrict outbound traffic from the WonderCMS server using firewall rules.
• Implement a web application firewall (WAF) with SSRF protection.
• Change default admin credentials immediately.
• Apply the hypothetical patch or use a reverse proxy to validate URLs.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to 169.254.169.254, 127.0.0.1, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16.
  • Requests to unusual ports (e.g., :3306, :6379, :27017).
• File IOCs:
  • Log entries in wondercms.log or PHP error logs containing file_get_contents failures for internal IPs.
• Behavioral IOCs:
  • Admin panel access from unexpected IPs.
  • Multiple failed login attempts followed by plugin page access.

Detection Engineering

YARA Rule

rule CVE_2024_41305_SSRF_WonderCMS {
    meta:
        description = "Detects SSRF exploitation attempts against WonderCMS CVE-2024-41305"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-41305"
    strings:
        $ssrf_payload = /pluginThemeUrl\s*=\s*(http|https|file|gopher|dict):\/\/(127\.0\.0\.1|10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|169\.254\.|0\.0\.0\.0)/
        $admin_page = "plugins.php" nocase
    condition:
        $admin_page and $ssrf_payload
}

Sigma Rule

title: WonderCMS SSRF Exploitation via pluginThemeUrl
id: 7a8b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects SSRF attempts against WonderCMS CVE-2024-41305
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'pluginThemeUrl'
        cs-uri-query|contains|expand:
            - '127.0.0.1'
            - '10.'
            - '172.16.'
            - '172.17.'
            - '172.18.'
            - '172.19.'
            - '172.20.'
            - '172.21.'
            - '172.22.'
            - '172.23.'
            - '172.24.'
            - '172.25.'
            - '172.26.'
            - '172.27.'
            - '172.28.'
            - '172.29.'
            - '172.30.'
            - '172.31.'
            - '192.168.'
            - '169.254.'
            - '0.0.0.0'
    condition: selection
falsepositives:
    - Legitimate plugin updates from internal repositories (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-41305 WonderCMS SSRF Exploitation";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"pluginThemeUrl"; http_client_body;
    pcre:"/pluginThemeUrl\s*=\s*(http|https|file|gopher|dict):\/\/(127\.0\.0\.1|10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|169\.254\.|0\.0\.0\.0)/Pi";
    sid:1000001;
    rev:1;
    reference:cve,2024-41305;
    classtype:attempted-recon;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the Plugins Page if not required – remove or restrict access to plugins.php.
2. Change default admin credentials – use strong, unique passwords.
3. Implement network segmentation – restrict outbound traffic from the WonderCMS server to only necessary destinations.
4. Apply a WAF rule to block requests containing private IP addresses in the pluginThemeUrl parameter.

Long-term Fix:

• Monitor the WonderCMS GitHub repository for an official patch.
• Consider migrating to a supported CMS if no patch is released.
• Apply the hypothetical code patch provided in this report.

Workaround:

• Use a reverse proxy (e.g., Nginx) to validate and sanitize the pluginThemeUrl parameter before it reaches the PHP application.

Valters IT
Securing Digital Frontiers