CVE-2022-0591: FormCraft3 WordPress Plugin SSRF Flaw

CVE-2022-0591 Overview

CVE-2022-0591 is a Server-Side Request Forgery (SSRF) vulnerability affecting the FormCraft WordPress plugin before version 3.8.28. The vulnerability exists because the plugin does not properly validate the URL parameter in the formcraft3_get AJAX action. This security flaw can be exploited by unauthenticated users, making it particularly dangerous for WordPress sites running vulnerable versions of the plugin.

Critical Impact

Unauthenticated attackers can exploit this SSRF vulnerability to make arbitrary HTTP requests from the vulnerable server, potentially accessing internal services, cloud metadata endpoints, and sensitive internal resources.

Affected Products

• FormCraft WordPress plugin versions prior to 3.8.28
• WordPress sites with FormCraft3 by Subtlewebinc installed
• Any web server hosting vulnerable FormCraft installations

Discovery Timeline

• 2022-03-21 - CVE-2022-0591 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-0591

Vulnerability Analysis

This SSRF vulnerability resides in the FormCraft WordPress plugin's AJAX handler. The formcraft3_get AJAX action accepts a URL parameter that is used to make server-side HTTP requests without proper validation. Because the endpoint is accessible via WordPress AJAX (typically at /wp-admin/admin-ajax.php), unauthenticated users can craft malicious requests that force the server to initiate outbound connections to arbitrary destinations.

The vulnerability is classified under CWE-918 (Server-Side Request Forgery), which describes scenarios where web applications fetch remote resources based on user-supplied input without sufficient validation. In this case, attackers can leverage the vulnerable WordPress server as a proxy to reach internal network resources, cloud metadata services (such as AWS IMDSv1 at 169.254.169.254), or other services that would normally be inaccessible from the internet.

Root Cause

The root cause of this vulnerability is insufficient input validation on the URL parameter passed to the formcraft3_get AJAX action. The plugin fails to implement proper URL allowlisting or validation mechanisms that would restrict requests to legitimate, expected destinations. Without these controls, any URL supplied by an attacker is processed by the server, enabling SSRF attacks.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can send a crafted POST request to the WordPress AJAX endpoint (/wp-admin/admin-ajax.php) with the action parameter set to formcraft3_get and a malicious URL in the target parameter. The server processes this request and fetches content from the attacker-specified URL, returning the response or potentially causing side effects on internal systems.

Potential exploitation scenarios include:

• Accessing internal services behind firewalls
• Retrieving cloud instance metadata containing credentials
• Scanning internal network ports and services
• Interacting with internal APIs without authentication
• Bypassing IP-based access controls

Detection Methods for CVE-2022-0591

Indicators of Compromise

• Unusual outbound HTTP/HTTPS requests from the web server to internal IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
• Requests to cloud metadata endpoints (169.254.169.254) originating from the WordPress server
• High volume of requests to /wp-admin/admin-ajax.php with the formcraft3_get action parameter
• Unexpected data exfiltration or lateral movement attempts from the WordPress host

Detection Strategies

• Monitor web server access logs for repeated requests to admin-ajax.php containing action=formcraft3_get
• Implement network monitoring to detect outbound connections from web servers to internal resources or metadata endpoints
• Deploy Web Application Firewall (WAF) rules to inspect AJAX requests for suspicious URL parameters
• Use intrusion detection systems to alert on SSRF patterns in HTTP traffic

Monitoring Recommendations

• Enable detailed logging for WordPress AJAX requests and review logs regularly
• Configure alerts for unusual outbound traffic patterns from web application servers
• Monitor DNS queries from the WordPress server for resolution of internal hostnames or suspicious domains
• Implement egress filtering and log any blocked outbound connection attempts

How to Mitigate CVE-2022-0591

Immediate Actions Required

• Update FormCraft WordPress plugin to version 3.8.28 or later immediately
• Audit WordPress installations to identify any sites running vulnerable FormCraft versions
• Review server logs for evidence of prior exploitation attempts
• Implement network-level egress filtering to restrict outbound connections from web servers

Patch Information

The vendor has addressed this vulnerability in FormCraft version 3.8.28. WordPress site administrators should update to this version or later through the WordPress plugin dashboard or by manually downloading the updated plugin. For detailed information about the vulnerability, refer to the WPScan Vulnerability Report.

Workarounds

• If immediate patching is not possible, consider temporarily disabling the FormCraft plugin until the update can be applied
• Implement WAF rules to block requests to admin-ajax.php containing the formcraft3_get action from untrusted sources
• Configure server-level egress filtering to prevent outbound connections to internal IP ranges and cloud metadata endpoints
• Restrict access to WordPress AJAX endpoints using IP allowlisting where feasible

# Example: Block cloud metadata endpoint access from web server (iptables)
iptables -A OUTPUT -d 169.254.169.254 -j DROP

# Example: Block internal network access from web server
iptables -A OUTPUT -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -j DROP