Server-Side Request Forgery in Visualizer Gutenberg REST Endpoints

Skrevet den af i Visualizer – Tables & Charts Manager

Visualizer registered its Gutenberg REST routes (/wp-json/visualizer/v1/upload-data, /update-chart, /get-permission-data and the chart_data REST field) without any permission check, so any unauthenticated visitor could reach them. By POSTing a crafted URL to the upload-data route an attacker made the site fetch an arbitrary address, allowing blind server-side request forgery against hosts reachable only from the server, and could also read or overwrite chart data. Fixed in 3.3.1 by requiring the ‘edit_posts’ capability in each REST callback.

This vulnerability affects the following application versions:

  • Visualizer – Tables & Charts Manager 3.1.0
  • Visualizer – Tables & Charts Manager 3.1.1
  • Visualizer – Tables & Charts Manager 3.1.2
  • Visualizer – Tables & Charts Manager 3.1.3
  • Visualizer – Tables & Charts Manager 3.2.0
  • Visualizer – Tables & Charts Manager 3.2.1
  • Visualizer – Tables & Charts Manager 3.3.0