Blind SSRF vulnerability Works on wordpress 6.1.1, is it covered with WAF?

Issue

WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP request, attackers can reach internal hosts that are explicitly forbidden. Does Imunify360 handle this attack?

Environment

• WordPress 6.1.1 and lower
• Imunify360
• ModSecurity

Solution

The rules for handling the attack were prepared and released on 21.12.2022 along with the WAF ruleset version 4.98.

Ruleset updates are installed automatically on the servers, and most often, server administrators do not need anything to update them. To update the ruleset manually, use the following command:

imunify360-agent update modsec-rules --force

Useful links

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3590
• https://changelog.imunify.com/waf-rules