Vulnerability in HubSpot WordPress Plugin

SEO September 30, 2024

0 4 2 minutes read

WPScan and the United States Government National Vulnerability Database released a notice regarding a vulnerability found in the HubSpot WordPress plugin. This vulnerability puts users at risk of a Server Side Request Forgery (SSRF) attack.

WPScan Vulnerability Report

Security researchers at WPScan issued the following report:

HubSpot < 8.8.15 – Contributor+ Blind SSRF

Description

The plugin does not validate the proxy URL given to the proxy REST endpoint, which could allow users with the edit_posts capability (by default contributor and above) to perform SSRF attacks.

Server Side Request Forgery (SSRF) Vulnerability

This vulnerability requires a contributor level user to be logged in for exposure to occur.

The non-profit Open Web Application Security Project (OWASP), an organization dedicated to software security, notes that an SSRF vulnerability can expose internal services not meant to be accessible.

According to OWASP:

“In a Server-Side Request Forgery (SSRF) attack, the attacker can abuse functionality on the server to read or update internal resources. The attacker can supply or modify a URL which the code running on the server will read or submit data to. By carefully selecting the URLs, the attacker may be able to read server configuration such as AWS metadata, connect to internal services like HTTP databases, or perform POST requests towards internal services which are not intended to be exposed.”

Services that shouldn’t be exposed include:

Cloud server meta-data
Database HTTP interfaces
Internal REST interfaces
Files – The attacker may be able to read files using <file://> URIs

HubSpot WordPress Plugin

The HubSpot WordPress plugin is used by over 200,000 publishers. It offers CRM, live chat, analytics, and email marketing capabilities.

The vulnerability discovered by WPScan was fixed in version 8.8.15. However, the software’s changelog shows that the HubSpot WordPress plugin received additional updates to address other vulnerabilities.

Updates according to the official changelog:

= 8.8.15 (2022-04-07) =
* Fix security issue related to proxy URL

= 8.9.14 (2022-04-12) =
* Fix security issue related to form inputs

= 8.9.20 (2022-04-13) =
* Fix security issue related to sanitizing inputs

While the security firm WPScan and the National Vulnerability Database state that the vulnerability was resolved in version 8.8.15, additional security fixes were made up to version 8.9.20.

Therefore, it may be wise to update the HubSpot plugin to at least version 8.9.20. The latest version of the HubSpot WordPress plugin, as of this writing, is version 8.11.0.