Exploit Author: Muhammad Zeeshan (Xib3rR4dAr)
The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Blind SSRF in versions up to, and including, 7.11.6. This makes it possible for authenticated attackers with contributor-level and above permissions to send requests to arbitrary hosts/urls with custom HTTP verb and headers.
Steps from Author:
- Login as author
- Visit http://example.com/wp-admin/admin.php?page=avada-forms
- Enter any name for form and click "Create New Form"
- In editor, "Text" tab would already be selected, if not then click "Text" tab and paste:
[fusion_form_submit]SubmitSSRF[/fusion_form_submit]
- Click "Submission" tab at bottom
- Click "AJAX" as "Submission Type"
- In "Action" textarea, click and select "Send to URL"
- Click pen button, set "Form submission URL" to any internal host URL along with custom GET parameters (POST params might also be appendable using form fields), click "Add Header" to add custom header along with custom value
- While frontend only shows HTTP verbs as POST/GET, but it can be changed to HEAD/PUT/DELETE also by modifying
_fusion[url_method]=to specified verb in request to/wp-admin/post.phpwhen "Update" button is clicked. - Click "Update" and notice form id from URL (post={form_id})
- Visit http://example.com/wp-admin/post-new.php to create a new post
- Enter any title for post
- In editor, "Text" tab would already be selected, if not then click "Text" tab and paste (replace form_post_id value with created form):
[fusion_form form_post_id="123" /]
- Click "Publish"
- Visit permalink of form shown below the title
- SSRF will trigger now when any user or author user himself visits the form and submits the form by clicking "SubmitSSRF"
Issue can also be exploited by contributor user but would require high privileged user to approve the form and post.
Endpoint: /wp-admin/post.php
Parameter _fusion[action] contains internal host.
Admin users can add whitelisted hosts to where forms can be sent. Also, use wp_safe_remote_request instead of wp_remote_request in wp-content/plugins/fusion-builder/inc/class-fusion-form-submit.php on line #321.
