CVE-2022-3590 WP <= 6.1.1 - Unauthenticated Blind SSRF via DNS Rebinding
Unauthenticated attackers can exploit a race condition in WordPress pingbacks to perform blind SSRF and access internal network resources.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-3590?
CVE-2022-3590 is a medium-severity server-side request forgery vulnerability in Wordpress Wordpress, published on 14 Dec 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP request, attackers can reach internal hosts that are explicitly forbidden.
Weakness: CWE-367
Which versions are affected by CVE-2022-3590?
2 open source packages ship an affected version, including wordpress and wordpress-multisite. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
wordpress Bitnami | From 4.1.0 | 4.1.1, 6.1.2 |
wordpress-multisite Bitnami | From 4.1.0 | 4.1.1, 6.1.2 |
Products include Wordpress Wordpress.
How do I fix CVE-2022-3590?
Upgrade wordpress to a fixed version for your release line: 4.1.1 or 6.1.2.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2022-3590 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-3590 exists.
Public exploit code: 1 Nuclei template and 3 proofs of concept on GitHub.
Other vulnerabilities in Wordpress Wordpress
Sources
Also known as BIT-wordpress-2022-3590, BIT-wordpress-multisite-2022-3590, DEBIAN-CVE-2022-3590, GHSA-mjj5-7gmf-mfjx, UBUNTU-CVE-2022-3590.