CVE-2025-28963

Executive Summary

CVE-2025-28963 is a Server-Side Request Forgery (SSRF) vulnerability discovered in the WordPress plugin URL Shortener exact-links, developed by Md Yeasin Ul Haider. The flaw affects all versions up to and including 3.0.7. An unauthenticated attacker can exploit this vulnerability to make the server send crafted HTTP requests to internal or external systems, potentially leading to information disclosure, internal network scanning, or further lateral attacks. The CVSS v3.1 base score is 5.4 (Medium), with a network attack vector and low complexity. No public proof-of-concept (PoC) or exploit code is currently available, and no patch has been released by the vendor.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository. As such, it affects the WordPress ecosystem directly. Users of the plugin are advised to monitor for updates from the plugin author or consider disabling the plugin until a patch is released. The lack of a patch and the nature of SSRF make this a supply chain risk for any WordPress site using this plugin.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the affected component are the same.
• Confidentiality (C): Low (L) – Limited information disclosure possible.
• Integrity (I): Low (L) – Limited ability to modify data or resources.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. While the CVSS score is moderate, SSRF vulnerabilities can be chained with other exploits to achieve higher impact, such as accessing cloud metadata endpoints (e.g., AWS, GCP) or internal services.

Deep Dive & Mechanics

The vulnerability exists in the URL Shortener plugin's functionality that processes user-supplied URLs for shortening. The plugin likely takes a long URL from the user and fetches it to validate or generate a short code. Due to insufficient validation of the target URL, an attacker can supply a URL pointing to internal resources (e.g., http://169.254.169.254/, http://localhost/, or internal IP addresses). The server then makes an HTTP request to that internal resource, potentially leaking sensitive data.

Attack Flow:

1. Attacker identifies the plugin's URL shortening endpoint (e.g., /wp-admin/admin-ajax.php?action=shorten_url).
2. Attacker submits a request with a malicious URL like http://169.254.169.254/latest/meta-data/.
3. The plugin's server-side code fetches this URL without proper validation.
4. The response from the internal resource is returned to the attacker, revealing cloud metadata or internal service information.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be in the plugin's core logic. A typical vulnerable pattern in PHP would be:

Vulnerable Code (PHP):

function shorten_url($url) {
    $response = wp_remote_get($url);
    // Process response...
}

Patched Code (Hypothetical):

function shorten_url($url) {
    $parsed_url = parse_url($url);
    $host = $parsed_url['host'];
    // Block private IP ranges and internal hostnames
    if (filter_var($host, FILTER_VALIDATE_IP) && !filter_var($host, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE)) {
        return new WP_Error('invalid_url', 'URL is not allowed');
    }
    $response = wp_remote_get($url);
    // Process response...
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress instance with the URL Shortener plugin (<=3.0.7) installed and activated.
• Network access to the WordPress admin or frontend endpoint that handles URL shortening.

Exploitation Steps:

1. Identify the AJAX action or endpoint used for URL shortening. Common patterns include:
   • /wp-admin/admin-ajax.php?action=exact_links_shorten
   • /wp-json/exact-links/v1/shorten
2. Craft a POST request with a malicious URL:

   POST /wp-admin/admin-ajax.php HTTP/1.1
   Host: target-wordpress-site.com
   Content-Type: application/x-www-form-urlencoded
   
   action=exact_links_shorten&url=http://169.254.169.254/latest/meta-data/
   

3. Observe the response. If successful, the response will contain the cloud metadata (e.g., IAM role credentials, instance ID).

Example cURL Command:

curl -X POST https://target-wordpress-site.com/wp-admin/admin-ajax.php \
  -d "action=exact_links_shorten&url=http://169.254.169.254/latest/meta-data/"

Blue Team (Detection & Hardening)

Detection:

• Monitor web server logs for requests to the URL shortening endpoint with suspicious URLs (e.g., containing 169.254.169.254, localhost, 127.0.0.1, or internal IP ranges).
• Look for outbound HTTP requests from the WordPress server to internal IP addresses or cloud metadata endpoints.

Hardening:

• Disable the plugin until a patch is available.
• Implement a Web Application Firewall (WAF) rule to block requests containing internal IP addresses or hostnames.
• Restrict outbound traffic from the WordPress server using network security groups or firewalls.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to 169.254.169.254 (AWS/GCP metadata)
  • Outbound HTTP requests to 169.254.169.253 (Azure metadata)
  • Outbound HTTP requests to 127.0.0.1, localhost, or 0.0.0.0
  • Outbound HTTP requests to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
• File IOCs:
  • Log entries containing action=exact_links_shorten with suspicious URL parameters.
• Behavioral IOCs:
  • Unusual server-side HTTP requests to internal services.

Detection Engineering

YARA Rule

rule CVE_2025_28963_SSRF_WordPress {
    meta:
        description = "Detects SSRF exploitation attempts against WordPress URL Shortener plugin"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-28963"
    strings:
        $action = "exact_links_shorten" nocase
        $url_param = "url=" nocase
        $internal_ip = /(169\.254\.|127\.|10\.|172\.(1[6-9]|2[0-9]|3[0-1])\.|192\.168\.)/ nocase
        $localhost = "localhost" nocase
    condition:
        $action and $url_param and ($internal_ip or $localhost)
}

Sigma Rule

title: CVE-2025-28963 SSRF Exploitation Attempt
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests to the WordPress URL Shortener plugin with internal IP addresses or hostnames
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains:
            - 'action=exact_links_shorten'
            - 'url=169.254.'
            - 'url=127.'
            - 'url=10.'
            - 'url=172.16.'
            - 'url=172.17.'
            - 'url=172.18.'
            - 'url=172.19.'
            - 'url=172.20.'
            - 'url=172.21.'
            - 'url=172.22.'
            - 'url=172.23.'
            - 'url=172.24.'
            - 'url=172.25.'
            - 'url=172.26.'
            - 'url=172.27.'
            - 'url=172.28.'
            - 'url=172.29.'
            - 'url=172.30.'
            - 'url=172.31.'
            - 'url=192.168.'
            - 'url=localhost'
    condition: selection
falsepositives:
    - Legitimate use of internal URLs (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-28963 SSRF Exploitation Attempt - WordPress URL Shortener";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=exact_links_shorten"; http_client_body;
    pcre:"/url=(169\.254\.|127\.|10\.|172\.(1[6-9]|2[0-9]|3[0-1])\.|192\.168\.|localhost)/i";
    classtype:attempted-recon;
    sid:10000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if it is not critical to operations.
2. Implement a WAF rule to block requests containing internal IP addresses or hostnames in the URL parameter.
3. Restrict outbound traffic from the WordPress server using firewall rules (e.g., AWS Security Groups, iptables).

Long-term Fix:

• The vendor must release a patched version that validates URLs against a whitelist of allowed external domains or blocks private IP ranges.
• Users should update to the latest version once a patch is available.

Workaround:

• If the plugin cannot be disabled, modify the plugin code to add URL validation (see patched code example above). However, this will be overwritten on plugin updates.

Valters IT