CVE-2024-13697
📋 TL;DR
This vulnerability allows unauthenticated attackers to perform Server-Side Request Forgery (SSRF) attacks via the 'nice_links' feature in the Better Messages WordPress plugin. Attackers can make arbitrary web requests from the vulnerable server, potentially accessing internal services and sensitive information. All WordPress sites using this plugin up to version 2.7.4 with 'Enable link previews' enabled (default setting) are affected.
💻 Affected Systems
- Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could access internal services, exfiltrate sensitive data from internal networks, perform port scanning, or interact with cloud metadata services to gain further access.
Likely Case
Attackers scanning internal networks, accessing internal web applications, or retrieving sensitive information from services that shouldn't be publicly accessible.
If Mitigated
Limited to internal network reconnaissance with no critical data exposure if proper network segmentation and access controls are implemented.
🎯 Exploit Status
SSRF vulnerabilities are commonly exploited and this one requires no authentication with default settings enabled.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.7.5
Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3243180/bp-better-messages
Restart Required: No
Instructions:
1. Log into WordPress admin panel
2. Navigate to Plugins → Installed Plugins
3. Find 'Better Messages' plugin
4. Click 'Update Now' if update is available
5. Alternatively, download version 2.7.5+ from WordPress repository and manually update
🔧 Temporary Workarounds
Disable Link Previews
allDisable the vulnerable 'Enable link previews' feature in plugin settings
Temporary Plugin Deactivation
linuxDeactivate the plugin until patched
wp plugin deactivate bp-better-messages
🧯 If You Can't Patch
- Implement network segmentation to restrict plugin server's access to internal services
- Deploy web application firewall (WAF) rules to block SSRF patterns and restrict outbound requests
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel → Plugins → Installed Plugins for 'Better Messages' version 2.7.4 or lowerCheck Version:
wp plugin get bp-better-messages --field=versionVerify Fix Applied:
Verify plugin version is 2.7.5 or higher in WordPress admin panel📡 Detection & Monitoring
Log Indicators:
- Unusual outbound HTTP requests from WordPress server to internal IP ranges
- Requests to metadata services (169.254.169.254, etc.)
- Multiple failed requests to internal services
Network Indicators:
- WordPress server making unexpected HTTP requests to internal network segments
- Requests to cloud provider metadata endpoints
SIEM Query:
source="wordpress-logs" AND (dest_ip IN (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.169.254) OR uri CONTAINS "nice_links")