CVE-2024-13924: Fancywp Starter Templates SSRF Vulnerability

CVE-2024-13924 Overview

A critical Blind Server-Side Request Forgery (SSRF) vulnerability has been identified in the Starter Templates by FancyWP plugin for WordPress. This vulnerability exists in all versions up to and including 2.0.0 and is exploitable through the http_request_host_is_external filter. The flaw allows unauthenticated attackers to initiate web requests to arbitrary locations from the vulnerable web application, potentially enabling them to query and modify information from internal services.

Critical Impact

Unauthenticated attackers can leverage this SSRF vulnerability to access internal network resources, potentially exposing sensitive data and enabling further attacks on internal infrastructure.

Affected Products

• Starter Templates by FancyWP versions up to and including 2.0.0
• WordPress installations with the vulnerable FancyWP Starter Templates plugin

Discovery Timeline

• 2025-03-08 - CVE-2024-13924 published to NVD
• 2025-03-12 - Last updated in NVD database

Technical Details for CVE-2024-13924

Vulnerability Analysis

This vulnerability is classified as CWE-918 (Server-Side Request Forgery). The Starter Templates by FancyWP plugin improperly handles the http_request_host_is_external filter, which is designed to determine whether a given host should be treated as external for HTTP requests. By exploiting this filter, attackers can bypass intended restrictions and force the WordPress server to make HTTP requests to arbitrary destinations.

The "blind" nature of this SSRF means that while attackers may not directly see the response from internal services, they can still infer information through timing-based techniques, error responses, or by directing responses to attacker-controlled systems.

Root Cause

The root cause lies in the improper implementation of the http_request_host_is_external filter within the plugin's export functionality. The vulnerable code can be found in the class-export.php file. The filter fails to properly validate and restrict the destinations for outbound HTTP requests, allowing attackers to specify internal or arbitrary external hosts as request targets.

Attack Vector

The vulnerability is exploitable over the network without any authentication requirements. An attacker can craft malicious requests that abuse the flawed filter implementation to:

1. Probe internal network infrastructure and services
2. Access cloud provider metadata endpoints (e.g., AWS EC2 metadata at 169.254.169.254)
3. Interact with internal APIs and services that are not exposed to the internet
4. Potentially pivot to other internal systems using the WordPress server as a proxy

The attack does not require any user interaction, making it particularly dangerous for internet-facing WordPress installations.

Detection Methods for CVE-2024-13924

Indicators of Compromise

• Unusual outbound HTTP requests from the WordPress server to internal IP ranges or cloud metadata endpoints
• Requests to the plugin's export functionality containing suspicious URL parameters
• Server logs showing connections to internal services from the web application process
• Network traffic analysis revealing the WordPress server attempting to access non-standard ports or internal hosts

Detection Strategies

• Monitor web application logs for requests to the Starter Templates plugin endpoints with anomalous URL parameters
• Implement network segmentation rules and alert on WordPress server attempts to reach internal-only services
• Deploy Web Application Firewall (WAF) rules to detect and block SSRF patterns in request parameters
• Review DNS query logs for unusual internal hostname lookups originating from the web server

Monitoring Recommendations

• Enable detailed logging for all outbound HTTP requests from the WordPress installation
• Configure network intrusion detection systems to alert on internal service access from DMZ hosts
• Implement egress filtering and monitor for violations from web application servers
• Set up alerts for access attempts to common SSRF targets such as cloud metadata endpoints

How to Mitigate CVE-2024-13924

Immediate Actions Required

• Update the Starter Templates by FancyWP plugin to a version newer than 2.0.0 if a patched version is available
• If no patch is available, consider temporarily deactivating the plugin until a fix is released
• Implement network-level controls to restrict outbound connections from the WordPress server
• Review and audit any systems that may have been accessed through SSRF exploitation

Patch Information

Organizations should check the Wordfence vulnerability report for the latest patch information and remediation guidance. Ensure that automatic updates are enabled for WordPress plugins where possible, and maintain a regular patching schedule for all WordPress components.

Workarounds

• Disable the Starter Templates by FancyWP plugin until a patched version is available
• Implement strict egress firewall rules to prevent the WordPress server from making connections to internal networks
• Deploy a Web Application Firewall with SSRF protection rules enabled
• Configure the web server to block requests containing internal IP addresses or localhost references in user-controllable parameters

# Example: Block common SSRF targets at the network level using iptables
# Block access to cloud metadata endpoints
iptables -A OUTPUT -d 169.254.169.254 -j DROP

# Block access to internal network ranges from web server
iptables -A OUTPUT -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -j DROP