O plugin Web Stories para WordPress é vulnerável a Server-Side Request Forgery em versões até, e incluindo 1.24.0 devido à validação insuficiente de URLs fornecidas via o parâmetro 'url' encontrado

The SSRF vulnerability in Web Stories allows an attacker, once authenticated within the WordPress site, to craft malicious requests through the /v1/hotlink/proxy endpoint. This bypasses URL validation, enabling the attacker to send requests to internal services that are not directly accessible from the outside. Successful exploitation could lead to information disclosure, modification of internal data, or even potential access to other systems within the same network. The impact is particularly severe because it can be leveraged to scan internal networks and identify vulnerable services, potentially leading to further compromise. This is similar to SSRF vulnerabilities found in other WordPress plugins where internal resources were inadvertently exposed.

Websites using the WordPress Web Stories plugin, particularly those with custom authentication mechanisms or internal services accessible via HTTP, are at risk. Shared hosting environments where multiple websites share the same server are also at increased risk, as a compromise of one site could potentially lead to exploitation of the vulnerability on other sites.

• wordpress / plugin:

wp plugin list | grep Web Stories

• wordpress / plugin: Check the version of the Web Stories plugin using wp plugin list and verify it is below 1.25.0. • wordpress / plugin: Review WordPress access logs for requests to /v1/hotlink/proxy originating from authenticated users. • wordpress / plugin: Examine the plugin's code for instances of URL validation related to the /v1/hotlink/proxy endpoint.

1. 2022-10-28Disclosure

   disclosure

1. Reservado2022-10-26
2. Publicada2022-10-28
3. Modificada2025-05-05
4. EPSS atualizado2026-04-02

The primary mitigation for CVE-2022-3708 is to immediately upgrade the WordPress Web Stories plugin to version 1.25.0 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing a Web Application Firewall (WAF) rule to block requests to the /v1/hotlink/proxy endpoint or restrict the allowed domains. Additionally, review and restrict the permissions of authenticated users to minimize the potential impact of a successful exploit. Monitor WordPress access logs for unusual outbound requests originating from the plugin.

Instalações ativas

70KConhecido

Avaliação do plugin

4.2

Requer WordPress

6.6+

Compatível até

6.8.5

Requer PHP

7.4+