# Wordpress 4.7 - CSRF -> HTTP SSRF any private ip:port and basic-auth

Press This scrape function follows attacker-controlled 302 redirects, bypassing IP/port filters to SSRF any internal host:port with injected basic-auth headers.

- Payout: hidden
- Severity: high
- Program: WordPress
- Found by: skansing
- Disclosed: 2017-11-20
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/187520
- Library page: https://bugbountylibrary.com/r/h1%3A187520
- Tags: area:web domain:web impact:internal-access kind:bounty platform:hackerone sev:high tech:php technique:chained vuln:csrf vuln:ssrf

**Target:** wp-admin/press-this.php scrape function
**Root cause:** The Press This scrape endpoint validates the initial URL's IP/port but blindly follows HTTP redirects, so a valid attacker host can redirect to any private ip:port; credentials in the redirect URL become an Authorization header.
**Steps:**
1. Victim with press-this privileges has an active session.
2. Deliver CSRF payload `<img src="//example.com/wp-admin/press-this.php?u=http://attackers-domain.com&url-scan-submit=Scan" />`.
3. Attacker domain replies `302` with `Location: http://192.168.0.1:12345`.
4. Server follows redirect and hits the internal ip:port.
5. Escalate with `Location: http://admin:admin@192.168.0.1:12345` to inject basic-auth.
**How found:** Built on prior report #110801 (SSRF limited to 0.0.0.0:80/443/8080); realized the IP/port filter only checked the initial URL, so a redirect from a valid host bypasses it.
**Exploitation:** CSRF forces the victim's WordPress server to scrape an attacker-controlled URL; the attacker's 302 redirect points to an arbitrary internal ip:port, and embedding user:pass in the redirect URL makes the server send an Authorization: Basic header to the internal endpoint.
**Escalation:** Adding basic-auth credentials to the redirect URL lets the attacker authenticate to internal services that require it.
**Insight:** When an SSRF filter validates only the submitted URL, test whether the fetcher follows redirects—a valid external host returning 302 to a private ip:port defeats the check, and userinfo in the redirect URL injects auth headers.