WPB Show Core <= 2.2 - Unauthenticated Server Side Request Forgery

2023-11-0600:00:00

Mohamed Abdelhady

wpscan.com

vulnerability

unauthenticated

server-side request forgery

plugin

get request

arbitrary url

download

response

software

9.5 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

43.5%

JSON

Description This plugin is vulnerable to server-side request forgery (SSRF) via the path parameter.

PoC

Send a GET request to wpb-show-core/download-file.php with the path parameter set to an arbitrary URL http://example.com/latest/meta-data/iam/security-credentials/wpb-apps-prod-role the website will download/response the files