CVE-2017-9066 (published 2017-05-18T14:29Z)

In WordPress before 4.7.5, there is insufficient redirect validation in the HTTP class, leading to SSRF.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 8.6, HIGH (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-918
cwe_name: Server-Side Request Forgery (SSRF)
description: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
extended_description: By providing URLs to unexpected hosts or ports, attackers can make it appear that the server is sending the request, possibly bypassing access controls such as firewalls that prevent the attackers from accessing the URLs directly. The server can be used as a proxy to conduct port scanning of hosts in internal networks, use other URLs such as that can access documents on the system (using file://), or use other protocols such as gopher:// or tftp://, which may provide greater control over the contents of requests.
         

Fix information:
repo_url: https://github.com/WordPress/WordPress
commit_details: repo_url: https://github.com/WordPress/WordPress
author: Pascal Birchler
author_date: 2017-05-16 08:38:42+00:00
msg: Improve redirect handling

Built from https://develop.svn.wordpress.org/trunk@40689


git-svn-id: http://core.svn.wordpress.org/trunk@40552 1a063a9b-81f0-0310-95a4-ce76da25c4cd
repository: repo_url: https://github.com/WordPress/WordPress
repo_name: WordPress/WordPress
description: WordPress, Git-ified. This repository is just a mirror of the WordPress subversion repository. Please do not send pull requests. Submit pull requests to https://github.com/WordPress/wordpress-develop and patches to https://core.trac.wordpress.org/ instead.
repo_language: PHP
owner: WordPress
file_changes: filename: class-http.php
change_type: ModificationType.MODIFY
diff: @@ -306,6 +306,11 @@ class WP_Http {
 		// Ensure redirects follow browser behaviour.
 		$options['hooks']->register( 'requests.before_redirect', array( get_class(), 'browser_redirect_compatibility' ) );
 
+		// Validate redirected URLs.
+		if ( function_exists( 'wp_kses_bad_protocol' ) && $r['reject_unsafe_urls'] ) {
+			$options['hooks']->register( 'requests.before_redirect', array( get_class(), 'validate_redirects' ) );
+		}
+
 		if ( $r['stream'] ) {
 			$options['filename'] = $r['filename'];
 		}
@@ -466,6 +471,20 @@ class WP_Http {
 		}
 	}
 
+	/**
+	 * Validate redirected URLs.
+	 *
+	 * @since 4.7.5
+	 *
+	 * @throws Requests_Exception On unsuccessful URL validation
+	 * @param string $location URL to redirect to.
+	 */
+	public static function validate_redirects( $location ) {
+		if ( ! wp_http_validate_url( $location ) ) {
+			throw new Requests_Exception( __('A valid URL was not provided.'), 'wp_http.redirect_failed_validation' );
+		}
+	}
+
 	/**
 	 * Tests which transports are capable of supporting the request.
 	 *

programming_language: PHP
filename: version.php
change_type: ModificationType.MODIFY
diff: @@ -4,7 +4,7 @@
  *
  * @global string $wp_version
  */
-$wp_version = '4.8-beta1-40677';
+$wp_version = '4.8-beta1-40689';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.

programming_language: PHP