Platform
wordpress
Component
nimble-portfolio
Opgelost in
3.0.2
A critical Server-Side Request Forgery (SSRF) vulnerability has been identified in the WordPress Picture / Portfolio / Media Gallery plugin, impacting versions up to 3.0.1. This flaw allows unauthenticated attackers to initiate arbitrary web requests from the plugin, potentially exposing internal resources and sensitive data. The vulnerability was publicly disclosed on June 19, 2024, and a fix is expected from the plugin developers.
The SSRF vulnerability in WordPress Picture / Portfolio / Media Gallery allows an attacker to craft malicious requests that appear to originate from the plugin itself. This can be exploited to query internal services that are not directly accessible from the outside world, such as databases, administrative interfaces, or other internal APIs. Successful exploitation could lead to information disclosure, privilege escalation, or even remote code execution if the internal services are vulnerable. The attacker could potentially map the internal network, identify other vulnerable services, and use this as a stepping stone for further attacks. This vulnerability is particularly concerning given the widespread use of WordPress and the potential for large-scale compromise.
CVE-2024-5021 is currently not listed on the CISA KEV catalog. Public proof-of-concept exploits are likely to emerge given the ease of exploitation and the plugin's popularity. The vulnerability's SSRF nature makes it a high-probability target for automated scanning and exploitation campaigns. The NVD entry was published on June 19, 2024, coinciding with the public disclosure.
WordPress websites using the Picture / Portfolio / Media Gallery plugin, particularly those with sensitive internal services accessible via HTTP or HTTPS, are at significant risk. Shared hosting environments where multiple websites share the same server infrastructure are also at increased risk, as a compromise of one website could potentially lead to the compromise of others.
• wordpress / composer / npm:
grep -r 'file_get_contents' /var/www/html/wp-content/plugins/picture-portfolio-media-gallery/• generic web:
curl -I https://your-wordpress-site.com/wp-content/plugins/picture-portfolio-media-gallery/ | grep Server• wordpress / composer / npm:
wp plugin list --status=inactive | grep 'picture-portfolio-media-gallery'disclosure
Exploit Status
EPSS
0.71% (72% percentiel)
CISA SSVC
CVSS-vector
The primary mitigation for CVE-2024-5021 is to immediately update the WordPress Picture / Portfolio / Media Gallery plugin to a version that addresses the SSRF vulnerability. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider implementing a Web Application Firewall (WAF) rule to block outbound requests to potentially sensitive internal resources. Restrict the plugin's access to external resources by implementing strict input validation and sanitization. Monitor web server access logs for unusual outbound requests originating from the plugin. After upgrading, confirm the fix by attempting to trigger an SSRF request and verifying that it is blocked.
Werk de WordPress Picture / Portfolio / Media Gallery plugin bij naar de laatste beschikbare versie. Dit corrigeert de Server-Side Request Forgery (SSRF) kwetsbaarheid en voorkomt dat niet-geauthenticeerde aanvallers webverzoeken naar willekeurige locaties vanuit uw webapplicatie kunnen uitvoeren.
Kwetsbaarheidsanalyses en kritieke waarschuwingen direct in uw inbox.
CVE-2024-5021 is a critical Server-Side Request Forgery (SSRF) vulnerability affecting WordPress Picture / Portfolio / Media Gallery plugin versions up to 3.0.1, allowing attackers to make arbitrary web requests.
You are affected if your WordPress site uses the Picture / Portfolio / Media Gallery plugin version 3.0.1 or earlier. Check your plugin versions immediately.
Upgrade the WordPress Picture / Portfolio / Media Gallery plugin to the latest available version. Implement WAF rules as a temporary workaround if immediate upgrade is not possible.
While no active exploitation has been confirmed, the vulnerability's ease of exploitation suggests it is likely to become a target for attackers.
Refer to the WordPress security announcements page and the plugin developer's website for updates and official advisories.
Upload je dependency-bestand en kom direct te weten of deze en andere CVEs jou raken.
Upload je dependency-bestand en kom direct te weten of deze en andere CVEs jou raken.