CVE-2024-41305
📋 TL;DR
This Server-Side Request Forgery (SSRF) vulnerability in WonderCMS v3.4.3 allows attackers to force the application to make arbitrary HTTP requests to internal or external systems by injecting crafted URLs into the pluginThemeUrl parameter. This affects all WonderCMS v3.4.3 installations with the vulnerable plugins page accessible.
💻 Affected Systems
- WonderCMS
📦 What is this software?
Wondercms by Wondercms
⚠️ Risk & Real-World Impact
Worst Case
Attackers could access internal services, perform port scanning, interact with cloud metadata services, or chain with other vulnerabilities to achieve remote code execution.
Likely Case
Information disclosure from internal services, reconnaissance of internal network, or limited interaction with adjacent systems.
If Mitigated
Limited impact if network segmentation restricts outbound connections and internal services require authentication.
🎯 Exploit Status
Exploitation requires crafting specific URLs but is straightforward once access to the vulnerable endpoint is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v3.4.4 or later
Vendor Advisory: https://github.com/robiso/wondercms/releases
Restart Required: No
Instructions:
1. Backup your current installation. 2. Download the latest version from the official repository. 3. Replace the vulnerable files with patched versions. 4. Verify the patch by testing the vulnerable endpoint.
🔧 Temporary Workarounds
Input Validation Filter
allAdd server-side validation to restrict pluginThemeUrl parameter to allowed domains or patterns
Modify relevant PHP files to validate URLs before processing
Network Restriction
linuxConfigure firewall rules to restrict outbound HTTP requests from the web server
iptables -A OUTPUT -p tcp --dport 80 -j DROP
iptables -A OUTPUT -p tcp --dport 443 -j DROP
🧯 If You Can't Patch
- Restrict access to the plugins page using authentication or IP whitelisting
- Implement a web application firewall (WAF) with SSRF protection rules
🔍 How to Verify
Check if Vulnerable:
Test the plugins page endpoint with a crafted URL parameter to see if it makes external requestsCheck Version:
Check the version.php file or admin panel for version informationVerify Fix Applied:
Attempt the same SSRF test after patching to confirm it no longer works📡 Detection & Monitoring
Log Indicators:
- Unusual outbound HTTP requests from web server
- Requests to internal IP addresses or cloud metadata services
Network Indicators:
- HTTP traffic from web server to unexpected destinations
- Port scanning patterns from web server
SIEM Query:
source="web_server_logs" AND (url CONTAINS "pluginThemeUrl" OR dest_ip IN [internal_ranges, 169.254.169.254])