Fediverse Embeds WordPress Plugin Server-Side Request Forgery Vulnerability

A server-side request forgery (SSRF) vulnerability has been identified in the Fediverse Embeds WordPress plugin, affecting versions prior to 1.5.8. The vulnerability arises because the plugin's media-proxying endpoint does not properly validate the destination of server-side requests. This flaw allows anonymous users to make the site fetch arbitrary URLs, including internal and private-network addresses, and read back the response body. The issue effectively creates an open proxy, enabling full-read SSRF exploitation.

Impact

Exploitation of this vulnerability allows for full-read server-side request forgery, where an attacker can make the server fetch and return data from internal or private-network resources.

Reproduction

To reproduce this vulnerability, first base64-encode the target URL, such as an internal address or a private network service like the AWS metadata service. Then, send an unauthenticated REST request to the media-proxy endpoint, including the base64-encoded URL. The response will contain the body of the fetched URL, demonstrating the SSRF vulnerability.

Remediation

Users are advised to update the Fediverse Embeds WordPress plugin to version 1.5.8 or later, where this vulnerability has been fixed.