Fediverse Embeds WordPress Plugin Unauthenticated Server-Side Request Forgery Vulnerability

A server-side request forgery (SSRF) vulnerability has been identified in the Fediverse Embeds WordPress plugin, affecting versions prior to 1.5.8. The vulnerability arises because the plugin's site-info endpoint does not properly validate the destination of server-side requests before fetching them. This flaw allows anonymous users to make requests to internal and private-network URLs, retrieving parsed page metadata from those locations. The issue is exacerbated by the exposure of the gating nonce on public pages with embeds, which can be exploited by unauthenticated users.

Impact

Exploitation of this vulnerability allows for server-side request forgery, where an attacker can make the server fetch internal or private-network resources and read back the data, potentially leading to the disclosure of sensitive information.

Reproduction

To reproduce this vulnerability, first obtain the public nonce from a front-end page that contains a Fediverse embed, as it is accessible to anonymous visitors. Alternatively, note that the FTF_FEDIVERSE_EMBEDS_PUBLIC_ACCESS constant can bypass the nonce requirement entirely. Once the nonce is obtained, send a POST request to 'wp-admin/admin-ajax.php' with the action 'ftf_get_site_info', the internal URL to be fetched, and the nonce. The response will include a JSON object with metadata parsed from the internal URL, confirming that the server-side request was successfully made.

Remediation

Users are advised to update the Fediverse Embeds WordPress plugin to version 1.5.8 or later, where this vulnerability has been fixed.