CVE-2024-51785

Executive Summary

CVE-2024-51785 is a Server-Side Request Forgery (SSRF) vulnerability discovered in the WordPress plugin "Responsive Filterable Portfolio" by Nks, affecting versions up to and including 1.0.22. This flaw allows an authenticated attacker with low privileges to make the server send crafted HTTP requests to internal or external resources, potentially leading to information disclosure or internal network reconnaissance. The vulnerability is classified as SSRF (CWE-918) and is currently unpatched, with no known public exploit code or active exploitation in the wild (EPSS 0.0%). The plugin is part of the WordPress ecosystem, and the vulnerability is not related to Apache or Nginx server software.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Since the plugin is unpatched, users are advised to remove or disable it immediately. No package manager (NPM, PyPI, Go, Ruby) is involved.

CVSS Breakdown & Threat Level

• CVSS Score: 4.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (potential internal network mapping)
• Integrity Impact: None
• Availability Impact: None

The low EPSS score (0.0%) indicates minimal active exploitation, but the unpatched status warrants immediate attention.

Deep Dive & Mechanics

The SSRF vulnerability in the Responsive Filterable Portfolio plugin arises from insufficient validation of user-supplied URLs used in server-side requests. The plugin likely fetches external resources (e.g., portfolio images or data) based on user input without proper sanitization or allowlisting. An attacker can manipulate this input to force the server to make requests to internal IP addresses (e.g., 127.0.0.1, 10.0.0.1) or cloud metadata endpoints (e.g., http://169.254.169.254/). This can lead to:

• Internal network scanning and service discovery.
• Access to sensitive internal services (e.g., databases, admin panels).
• Potential cloud metadata exfiltration (if hosted on AWS, GCP, Azure).

The vulnerability is triggered via the plugin's AJAX or REST API endpoints that accept URL parameters. No authentication bypass is required, but a valid WordPress user account with subscriber-level privileges is sufficient.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be in the plugin's core request handling. A typical vulnerable pattern might look like:

// Vulnerable code (hypothetical)
$url = $_POST['portfolio_url'];
$response = wp_remote_get($url); // No validation

A patched version would include:

// Patched code (hypothetical)
$url = $_POST['portfolio_url'];
$allowed_hosts = ['example.com', 'api.example.com'];
$parsed_url = parse_url($url);
if (in_array($parsed_url['host'], $allowed_hosts)) {
    $response = wp_remote_get($url);
} else {
    // Reject request
}

Exploitation & Lab Setup

Red Team

Prerequisites: A WordPress instance with the Responsive Filterable Portfolio plugin (<=1.0.22) and a low-privilege user account.

Exploitation Steps:

1. Identify the vulnerable endpoint (e.g., /wp-admin/admin-ajax.php?action=portfolio_fetch).
2. Craft a POST request with a manipulated URL parameter:

   POST /wp-admin/admin-ajax.php HTTP/1.1
   Host: target.com
   Content-Type: application/x-www-form-urlencoded
   
   action=portfolio_fetch&url=http://169.254.169.254/latest/meta-data/
   

3. Observe the response for internal metadata or error messages revealing internal IPs.

Lab Setup:

• Use Docker to deploy a vulnerable WordPress environment:

  docker run --name wp-vuln -e WORDPRESS_DB_HOST=db -e WORDPRESS_DB_USER=wpuser -e WORDPRESS_DB_PASSWORD=pass -e WORDPRESS_DB_NAME=wpdb -p 8080:80 -d wordpress:latest
  

• Install the plugin manually from the repository (version 1.0.22).
• Create a low-privilege user and test the exploit.

Blue Team

Detection Steps:

• Monitor outbound HTTP requests from the web server to unexpected internal IPs (e.g., 10.x.x.x, 172.16.x.x, 192.168.x.x, 169.254.x.x).
• Look for requests to cloud metadata endpoints (169.254.169.254).
• Analyze WordPress logs for suspicious AJAX calls with URL parameters.

Hunting Query (Splunk):

index=web sourcetype=access_combined
| search uri="/wp-admin/admin-ajax.php" action=portfolio_fetch
| rex field=uri "url=(?<target_url>[^&]+)"
| search target_url IN ("http://169.254.169.254*", "http://127.0.0.1*", "http://10.*", "http://172.16.*", "http://192.168.*")
| table _time, src_ip, target_url, status

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).
  • Requests to cloud metadata IPs (169.254.169.254).
  • Unusual User-Agent strings (e.g., empty or custom).
• File IOCs:
  • Plugin file: /wp-content/plugins/responsive-filterable-portfolio/ (version 1.0.22).
• Log IOCs:
  • Repeated admin-ajax.php calls with action=portfolio_fetch and url parameter.

Detection Engineering

YARA Rule

rule CVE_2024_51785_SSRF_WordPress {
    meta:
        description = "Detects SSRF exploitation attempts against Responsive Filterable Portfolio plugin"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-51785"
    strings:
        $ajax_action = "action=portfolio_fetch"
        $url_param = "url=http://"
        $internal_ip = /url=http:\/\/(127\.0\.0\.1|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|169\.254\.\d{1,3}\.\d{1,3})/
    condition:
        $ajax_action and $url_param and $internal_ip
}

Sigma Rule

title: SSRF via Responsive Filterable Portfolio Plugin
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SSRF attempts targeting internal IPs via WordPress plugin
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: "action=portfolio_fetch"
        cs-uri-query|contains: "url=http://"
    filter:
        cs-uri-query|contains:
            - "url=http://127.0.0.1"
            - "url=http://10."
            - "url=http://172.16."
            - "url=http://192.168."
            - "url=http://169.254."
    condition: selection and filter
falsepositives:
    - Legitimate use of internal resources (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-51785 SSRF Attempt - Responsive Filterable Portfolio";
    flow:to_server,established;
    content:"action=portfolio_fetch"; http_uri;
    content:"url=http://"; http_uri;
    pcre:"/url=http:\/\/(127\.0\.0\.1|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|169\.254\.\d{1,3}\.\d{1,3})/Ri";
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Since no official patch is available, immediate actions include:

1. Disable or Remove the Plugin: Deactivate and delete the Responsive Filterable Portfolio plugin from all WordPress installations.
2. Web Application Firewall (WAF) Rules: Block requests containing action=portfolio_fetch with suspicious URL parameters (internal IPs).
3. Network Segmentation: Restrict outbound HTTP access from the web server to only necessary external hosts.
4. Monitor Logs: Actively search for SSRF patterns using the provided detection rules.
5. Alternative Plugin: Replace with a patched or alternative portfolio plugin.

Long-term: Apply patches when the vendor releases an update. Consider contributing to the plugin's security by reporting the issue.

Valters IT
Securing Digital Frontiers