Server-Side Request Forgery and Stored Cross-Site Scripting in Greenshift Plugin for WordPress

CVE-2024-6155

Summary

The Greenshift plugin for WordPress presents a risk where certain authenticated users (Subscriber level or higher) can exploit a lack of capability checks in the greenshift_download_file_localy function. This vulnerability allows for Server-Side Request Forgery (SSRF) attacks, facilitating web requests to unauthorized external locations. Additionally, it exposes the application to potential attacks via malicious SVG file uploads that could inject Cross-Site Scripting (XSS) payloads into the server. The issue is critical for cloud-based servers as attackers may gain access to sensitive instance metadata. The incomplete security measure was partially remedied in version 8.9.9 and fully addressed in version 9.0.1.

References