Input validation error in WordPress

1) Input validation error

EUVDB-ID: #VU40279

Risk: High

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2016-2222

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The wp_http_validate_url function in wp-includes/http.php in WordPress before 4.4.2 allows remote attackers to conduct server-side request forgery (SSRF) attacks via a zero value in the first octet of an IPv4 address in the u parameter to wp-admin/press-this.php. <a href="https://cwe.mitre.org/data/definitions/918.html">CWE-918: Server-Side Request Forgery (SSRF)</a>

Mitigation

Install update from vendor's website.

Vulnerable software versions

WordPress: 4.4.1

CPE2.3

• cpe:2.3:a:wordpress_org:wordpress:4.4.1:*:*:*:*:*:*:*

External links

https://www.debian.org/security/2016/dsa-3472
https://www.securityfocus.com/bid/82454
https://www.securitytracker.com/id/1034933
https://codex.wordpress.org/Version_4.4.2
https://core.trac.wordpress.org/changeset/36435
https://hackerone.com/reports/110801
https://news.ycombinator.com/item?id=20433070
https://wordpress.org/news/2016/02/wordpress-4-4-2-security-and-maintenance-release/
https://wpvulndb.com/vulnerabilities/8376

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.