CVE-2017-16870 : What You Need to Know

UpdraftPlus plugin for WordPress version 1.13.12 has a Server Side Request Forgery (SSRF) vulnerability in the updraft_ajax_handler function located in /wp-content/plugins/updraftplus/admin.php. The vendor has reported that this vulnerability does not violate any privilege boundary.

Understanding CVE-2017-16870

This CVE involves a specific vulnerability in the UpdraftPlus plugin for WordPress.

What is CVE-2017-16870?

The UpdraftPlus plugin for WordPress version 1.13.12 is susceptible to a Server Side Request Forgery (SSRF) vulnerability due to the use of an httpget subaction in the updraft_ajax_handler function.

The Impact of CVE-2017-16870

This vulnerability could potentially be exploited by attackers to perform unauthorized actions through the affected plugin.

Technical Details of CVE-2017-16870

The technical aspects of this CVE are as follows:

Vulnerability Description

The SSRF vulnerability in the updraft_ajax_handler function in /wp-content/plugins/updraftplus/admin.php allows attackers to manipulate server requests.

Affected Systems and Versions

Product: UpdraftPlus plugin for WordPress
Vendor: UpdraftPlus
Version: 1.13.12

Exploitation Mechanism

Attackers can exploit this vulnerability by using an httpget subaction to trigger unauthorized server requests.

Mitigation and Prevention

To address CVE-2017-16870, consider the following steps:

Immediate Steps to Take

Disable or remove the UpdraftPlus plugin if not essential
Monitor for any unusual server requests or activities

Long-Term Security Practices

Regularly update plugins and software to patch vulnerabilities
Implement network security measures to prevent SSRF attacks

Patching and Updates

Check for updates or patches from UpdraftPlus to address this vulnerability