Responsive Lightbox & Gallery Server-Side Request Forgery Vulnerability

A server-side request forgery (SSRF) vulnerability has been identified in the Responsive Lightbox & Gallery plugin for WordPress, affecting all versions through 2.7.1. The vulnerability arises from inadequate hostname validation in the 'ajax_upload_image()' function, allowing authenticated attackers with Author-level access or higher to send web requests to arbitrary locations. This could be exploited to interact with and potentially modify information from internal services.

Impact

Exploitation of this vulnerability allows for server-side request forgery, enabling attackers to make requests from the server to internal services or external sites, which could be used to access or manipulate sensitive information.

Reproduction

To reproduce this vulnerability, an authenticated user with Author-level access or higher can upload an image through the remote library feature of the Responsive Lightbox & Gallery plugin. During the upload process, the plugin's hostname validation can be bypassed, allowing the user to make requests to internal services or arbitrary external locations.

Remediation

Users are advised to update the Responsive Lightbox & Gallery plugin to version 2.7.2 or later, where this vulnerability has been patched.