CVE-2025-12359

Executive Summary

CVE-2025-12359 is a Server-Side Request Forgery (SSRF) vulnerability in the WordPress plugin Responsive Lightbox & Gallery by Dfactory, affecting all versions up to and including 2.5.3. The flaw resides in the get_image_size_by_url function, which insufficiently validates user-supplied URLs when determining image dimensions for gallery items. This allows authenticated attackers with Author-level access or higher to make arbitrary web requests from the vulnerable WordPress server, potentially accessing internal services, querying sensitive data, or modifying internal resources.

The vulnerability has a CVSS score of 5.4 (Medium), with a network attack vector, low attack complexity, and low privileges required. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the impact on confidentiality and integrity of internal services is significant. No public proof-of-concept or exploit code is available at this time.

WordPress Ecosystem Context

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is installed on WordPress sites and the flaw is triggered through WordPress admin functions. The attack surface is limited to authenticated users with Author-level access or higher, which reduces the risk for unauthenticated attackers but still poses a threat in multi-author WordPress environments.

CVSS Breakdown & Threat Level

• CVSS Score: 5.4 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector (AV): Network – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low – No special conditions or complex attack sequences are required.
• Privileges Required (PR): Low – Attacker needs Author-level access or higher.
• User Interaction (UI): None – No user action is needed for exploitation.
• Scope (S): Changed – The vulnerable component impacts resources beyond its security scope (internal services).
• Confidentiality (C): Low – Limited information disclosure from internal services.
• Integrity (I): Low – Limited ability to modify internal service data.
• Availability (A): None – No impact on availability.

Threat Level: Medium. While the CVSS score is moderate, the SSRF nature can lead to lateral movement and data exfiltration in cloud or internal network environments.

Deep Dive & Mechanics

The vulnerability exists in the get_image_size_by_url function within the Responsive Lightbox & Gallery plugin. This function is designed to fetch image dimensions from a URL provided by the user when adding or editing gallery items. The function uses PHP's getimagesize() or similar functions to retrieve image metadata from the supplied URL.

The core issue is insufficient validation of the URL. The plugin does not properly restrict the URL scheme (e.g., http://, https://, file://, gopher://) or the target host. An authenticated attacker with Author-level access can craft a malicious URL pointing to internal services (e.g., http://169.254.169.254/latest/meta-data/ for AWS metadata, http://localhost:9200/ for Elasticsearch, or http://internal-admin:8080/ for internal admin panels). The plugin then makes a server-side request to that URL, and the response (or error) can be used to infer information or modify state.

The attack flow:

1. Attacker logs in with Author-level credentials.
2. Attacker creates or edits a gallery item.
3. Attacker supplies a malicious URL in the image URL field.
4. The plugin calls get_image_size_by_url with the attacker-controlled URL.
5. The server makes an HTTP request to the internal service.
6. The response is processed (e.g., image dimensions are returned or an error is shown), potentially leaking information or allowing state-changing operations.

Vulnerable vs. Patched Code

Since no official patch is available, the vulnerable code is assumed to be in the get_image_size_by_url function. A patched version would include proper URL validation.

Vulnerable Code (Conceptual):

function get_image_size_by_url($url) {
    // No validation of URL scheme or host
    $size = @getimagesize($url);
    if ($size) {
        return array('width' => $size[0], 'height' => $size[1]);
    }
    return false;
}

Patched Code (Conceptual):

function get_image_size_by_url($url) {
    // Validate URL scheme
    $allowed_schemes = array('http', 'https');
    $parsed_url = parse_url($url);
    if (!in_array($parsed_url['scheme'], $allowed_schemes)) {
        return false;
    }
    // Validate host against a whitelist or block private IPs
    $host = $parsed_url['host'];
    if (filter_var($host, FILTER_VALIDATE_IP) && !filter_var($host, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE)) {
        return false;
    }
    // Use a safe HTTP client with timeout and redirect limits
    $response = wp_remote_get($url, array('timeout' => 5, 'redirection' => 0));
    if (is_wp_error($response)) {
        return false;
    }
    $body = wp_remote_retrieve_body($response);
    // Process image data safely
    $size = @getimagesizefromstring($body);
    if ($size) {
        return array('width' => $size[0], 'height' => $size[1]);
    }
    return false;
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with Responsive Lightbox & Gallery plugin version <= 2.5.3.
• Author-level user credentials.

Exploitation Steps:

1. Log in to WordPress as an Author.
2. Navigate to "Media" > "Gallery" or "Add New Gallery".
3. In the gallery item URL field, enter a malicious URL targeting internal services. For example:
   • AWS metadata: http://169.254.169.254/latest/meta-data/
   • Internal admin: http://192.168.1.100/admin
   • Elasticsearch: http://localhost:9200/
4. Save the gallery item.
5. The plugin will make a server-side request to the supplied URL. The response may be reflected in the gallery item's image dimensions or error messages.

Example Payload:

http://169.254.169.254/latest/meta-data/iam/security-credentials/admin

Expected Outcome: The attacker can read sensitive data from internal services, such as cloud metadata or internal API responses.

Blue Team

Detection Steps:

1. Monitor outbound HTTP requests from the WordPress server to internal IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16).
2. Look for requests to cloud metadata endpoints (e.g., 169.254.169.254).
3. Review WordPress access logs for Author-level users creating or editing gallery items with unusual URLs.
4. Check for error messages in WordPress logs that indicate failed image dimension retrieval from internal hosts.

Mitigation Steps:

• Disable the plugin until a patch is available.
• Implement a web application firewall (WAF) rule to block requests to private IP ranges from the plugin.
• Restrict outbound network access from the WordPress server to only necessary external services.
• Monitor for anomalous outbound traffic.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound HTTP requests from the WordPress server to private IP addresses (e.g., 10.x.x.x, 172.16-31.x.x, 192.168.x.x, 169.254.x.x).
  • Requests to cloud metadata endpoints (e.g., 169.254.169.254, 100.100.100.200 for Alibaba Cloud).
  • Requests to internal service ports (e.g., 9200 for Elasticsearch, 6379 for Redis, 3306 for MySQL).

• File IOCs:

  • Modified gallery item entries in the WordPress database with suspicious URLs.
  • Log entries in /var/log/apache2/access.log or /var/log/nginx/access.log showing requests to internal IPs from the WordPress server.

• Behavioral IOCs:

  • Author-level users creating or editing gallery items with URLs pointing to internal hosts.
  • Unexplained outbound connections from the WordPress server to internal services.

Detection Engineering

YARA Rule

rule CVE_2025_12359_SSRF {
    meta:
        description = "Detects SSRF attempts via Responsive Lightbox & Gallery plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-12359"
    strings:
        $url_pattern = /(http|https):\/\/(10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|169\.254\.\d{1,3}\.\d{1,3}|localhost|127\.0\.0\.1)/
        $function_call = "get_image_size_by_url"
    condition:
        $url_pattern and $function_call
}

Sigma Rule

title: CVE-2025-12359 SSRF via Responsive Lightbox & Gallery
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects outbound HTTP requests to private IP ranges from WordPress server
author: Valters IT
date: 2025-04-10
logsource:
    category: network_connection
    product: linux
detection:
    selection:
        DestinationIp:
            - '10.0.0.0/8'
            - '172.16.0.0/12'
            - '192.168.0.0/16'
            - '169.254.0.0/16'
            - '127.0.0.0/8'
        InitiatedBy: 'wordpress'
    condition: selection
falsepositives:
    - Legitimate admin actions using internal services
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-12359 SSRF Attempt"; flow:to_server; content:"get_image_size_by_url"; http_uri; content:"http://"; http_uri; pcre:"/(10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|169\.254\.\d{1,3}\.\d{1,3}|localhost|127\.0\.0\.1)/Ri"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not critical to operations.
2. Restrict outbound network access from the WordPress server using firewall rules to block private IP ranges.
3. Implement a WAF rule to block requests containing private IP addresses in the URL parameter.

Long-term Fix:

• Apply a patch from the vendor once available. If no patch is forthcoming, consider forking the plugin and implementing proper URL validation as shown in the patched code section.
• Upgrade to a patched version when released.

Workarounds:

• Use a content security policy (CSP) to restrict outbound connections.
• Monitor and audit Author-level user activities.
• Implement a proxy that validates all outbound requests from the WordPress server.

Valters IT