CVE-2025-49917

Executive Summary

CVE-2025-49917 is a Server-Side Request Forgery (SSRF) vulnerability in the Icegram Express Pro WordPress plugin (email-subscribers-premium), affecting versions up to and including 5.9.5. This flaw allows an authenticated attacker with low privileges to make the server send crafted requests to internal or external resources, potentially leading to information disclosure, internal network scanning, or access to cloud metadata endpoints. The vulnerability is classified as medium severity (CVSS 4.4) and currently remains unpatched by the vendor. No public proof-of-concept (PoC) or exploit code has been released, but the risk is elevated due to the widespread use of this plugin in WordPress ecosystems.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository and premium marketplaces. Since no patch is available, users must rely on manual mitigation or plugin deactivation. The lack of a vendor fix introduces supply chain risk, as compromised sites could be leveraged for lateral movement or data exfiltration.

CVSS Breakdown & Threat Level

• CVSS Score: 4.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: None
• Availability Impact: None

Threat Level: Medium. While the impact is limited to low confidentiality loss, the SSRF can be chained with other vulnerabilities (e.g., cloud metadata access) to escalate privileges or pivot within internal networks.

Deep Dive & Mechanics

The vulnerability resides in the Icegram Express Pro plugin's handling of user-supplied URLs during email campaign creation or subscriber management. The plugin fails to validate or sanitize URLs passed to server-side functions that fetch remote resources (e.g., for tracking pixels, unsubscribe links, or image embedding). An attacker can inject a malicious URL pointing to internal services (e.g., http://169.254.169.254/latest/meta-data/ for AWS metadata) or external systems.

Root Cause: The plugin uses functions like wp_remote_get() or file_get_contents() without proper URL validation or allowlisting. The lack of a blocklist for private IP ranges (RFC 1918) and loopback addresses enables SSRF.

Attack Flow:

1. Attacker authenticates as a subscriber or admin.
2. Attacker crafts a request to the plugin's AJAX endpoint (e.g., admin-ajax.php?action=icegram_express_fetch_url).
3. The plugin processes the url parameter and makes a server-side request.
4. The response is reflected or used internally, allowing the attacker to read internal resources.

Vulnerable vs. Patched Code

Vulnerable Code (<= 5.9.5):

function icegram_express_fetch_url() {
    $url = $_POST['url'];
    $response = wp_remote_get($url);
    if (!is_wp_error($response)) {
        echo wp_remote_retrieve_body($response);
    }
    wp_die();
}
add_action('wp_ajax_icegram_express_fetch_url', 'icegram_express_fetch_url');

Patched Code (Hypothetical):

function icegram_express_fetch_url() {
    $url = $_POST['url'];
    $parsed_url = parse_url($url);
    $host = $parsed_url['host'] ?? '';
    // Block private IP ranges
    if (filter_var($host, FILTER_VALIDATE_IP) && !filter_var($host, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE)) {
        wp_die('Blocked');
    }
    // Allowlist only specific domains
    $allowed_hosts = ['tracking.example.com', 'images.example.com'];
    if (!in_array($host, $allowed_hosts)) {
        wp_die('Blocked');
    }
    $response = wp_remote_get($url, ['timeout' => 5]);
    if (!is_wp_error($response)) {
        echo wp_remote_retrieve_body($response);
    }
    wp_die();
}
add_action('wp_ajax_icegram_express_fetch_url', 'icegram_express_fetch_url');

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with Icegram Express Pro <= 5.9.5 installed and activated.
• Valid user credentials (subscriber or higher).

Exploitation Steps:

1. Identify the vulnerable AJAX action: icegram_express_fetch_url.
2. Craft a POST request to wp-admin/admin-ajax.php with the url parameter set to an internal resource.
3. Example using cURL:

   curl -X POST http://target.com/wp-admin/admin-ajax.php \
     -d "action=icegram_express_fetch_url&url=http://169.254.169.254/latest/meta-data/"
   

4. The response will contain the AWS metadata (if hosted on AWS).

Advanced Exploitation:

• Use SSRF to scan internal ports (e.g., http://127.0.0.1:8080).
• Chain with other vulnerabilities (e.g., file read via file:// protocol if supported).

Blue Team

Detection:

• Monitor for unusual AJAX requests to admin-ajax.php with action=icegram_express_fetch_url.
• Alert on URLs containing private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or loopback (127.0.0.0/8).
• Use WAF rules to block requests to internal IPs.

Mitigation:

• Disable the plugin until a patch is available.
• Implement a web application firewall (WAF) rule to block SSRF attempts.
• Restrict outbound traffic from the WordPress server using network ACLs.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound requests to private IP ranges (e.g., 10.x.x.x, 172.16.x.x, 192.168.x.x).
  • Requests to cloud metadata endpoints (e.g., 169.254.169.254, 100.100.100.200).
  • Unusual User-Agent strings in server logs (e.g., empty or custom).
• File IOCs:
  • Log entries in wp-content/debug.log showing failed URL fetches.
  • Modified plugin files (e.g., email-subscribers-premium/ directory).
• Process IOCs:
  • PHP processes making outbound HTTP connections to internal IPs.

Detection Engineering

YARA Rule

rule CVE_2025_49917_SSRF {
    meta:
        description = "Detect SSRF exploitation attempts against Icegram Express Pro"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-49917"
    strings:
        $ajax_action = "icegram_express_fetch_url"
        $private_ip = /(10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|127\.\d{1,3}\.\d{1,3}\.\d{1,3})/
        $metadata = "169.254.169.254"
    condition:
        $ajax_action and ($private_ip or $metadata)
}

Sigma Rule

title: SSRF Exploitation via Icegram Express Pro
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SSRF attempts targeting Icegram Express Pro plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=icegram_express_fetch_url'
        cs-uri-query|contains: 
            - 'url=http://10.'
            - 'url=http://172.'
            - 'url=http://192.168.'
            - 'url=http://127.'
            - 'url=http://169.254.'
    condition: selection
falsepositives:
    - Legitimate use of internal URLs (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-49917 SSRF Attempt - Icegram Express Pro";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"admin-ajax.php"; http_uri;
    content:"action=icegram_express_fetch_url"; http_client_body;
    pcre:"/url=http:\/\/(10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|127\.\d{1,3}\.\d{1,3}\.\d{1,3}|169\.254\.\d{1,3}\.\d{1,3})/Ri";
    sid:10000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin: Deactivate Icegram Express Pro until a patch is released.
2. Apply WAF rules: Block POST requests to admin-ajax.php containing action=icegram_express_fetch_url and private IPs.
3. Network segmentation: Restrict outbound traffic from the WordPress server to only necessary external services.

Long-term Fix:

• Monitor the vendor's website for a patched version (expected > 5.9.5).
• Implement input validation and allowlisting for all URL parameters in custom plugins.
• Use a WordPress security plugin (e.g., Wordfence) to detect SSRF attempts.

Workaround:

• If the plugin is critical, modify the vulnerable function to add URL validation (see patched code example) or use a reverse proxy to filter requests.

Valters IT