CVE-2020-35313
📋 TL;DR
This SSRF vulnerability in WonderCMS 3.1.3 allows remote attackers to execute arbitrary code by exploiting the theme/plugin installer functionality. Attackers can craft malicious URLs that trigger server-side requests to internal systems, potentially leading to remote code execution. All WonderCMS 3.1.3 installations with the vulnerable code are affected.
💻 Affected Systems
- WonderCMS
📦 What is this software?
Wondercms by Wondercms
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with remote code execution, data exfiltration, and lateral movement to internal networks.
Likely Case
Server takeover leading to website defacement, data theft, and installation of backdoors or malware.
If Mitigated
Limited impact if proper network segmentation and input validation are implemented.
🎯 Exploit Status
Exploitation requires authentication to the admin panel. Multiple public PoCs exist.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.1.4 and later
Vendor Advisory: https://github.com/robiso/wondercms
Restart Required: No
Instructions:
1. Backup your WonderCMS installation. 2. Download WonderCMS 3.1.4 or later from the official repository. 3. Replace the vulnerable index.php file with the patched version. 4. Verify the fix by checking the version in the admin panel.
🔧 Temporary Workarounds
Disable theme/plugin installer
allRemove or restrict access to the vulnerable addCustomThemePluginRepository function.
# Edit index.php and comment out or remove the vulnerable function
Restrict admin panel access
allLimit admin panel access to specific IP addresses using .htaccess or web server configuration.
# In .htaccess: Order deny,allow
Deny from all
Allow from 192.168.1.100
🧯 If You Can't Patch
- Implement strict network segmentation to isolate the WonderCMS server from internal systems.
- Deploy a web application firewall (WAF) with SSRF protection rules.
🔍 How to Verify
Check if Vulnerable:
Check if your WonderCMS version is 3.1.3 by logging into the admin panel and viewing the version in the footer.Check Version:
# Check the version in the admin panel footer or in index.phpVerify Fix Applied:
After patching, verify the version shows 3.1.4 or later in the admin panel footer.📡 Detection & Monitoring
Log Indicators:
- Unusual requests to index.php with URL parameters
- Requests to internal IP addresses from the WonderCMS server
- Unexpected theme/plugin installation attempts
Network Indicators:
- Outbound connections from WonderCMS server to internal services
- Unusual port scanning activity from the web server
SIEM Query:
source="web_server_logs" AND (uri="/index.php" AND (param="addCustomThemePluginRepository" OR param CONTAINS "http://" OR param CONTAINS "://"))🔗 References
- https://github.com/robiso/wondercms
- https://packetstormsecurity.com/files/160310/WonderCMS-3.1.3-Code-Execution-Server-Side-Request-Forgery.html
- https://zetc0de.github.io/post/authenticated-rce-ssrf-wondercms/
- https://github.com/robiso/wondercms
- https://packetstormsecurity.com/files/160310/WonderCMS-3.1.3-Code-Execution-Server-Side-Request-Forgery.html
- https://zetc0de.github.io/post/authenticated-rce-ssrf-wondercms/
