CVE-2023-4728

Executive Summary

CVE-2023-4728 is a Missing Authorization vulnerability in the LadiApp WordPress plugin, affecting versions up to and including 4.4. The flaw resides in the publish_lp() function, which is accessible via an AJAX action. Due to a missing capability check, authenticated attackers with subscriber-level access or higher can arbitrarily modify the LadiPage key. This allows an attacker to create new pages, including those containing stored Cross-Site Scripting (XSS) payloads. The vulnerability has a CVSS score of 4.3 (Medium) and currently has no known public exploit or patch.

Supply Chain & Package Security

This vulnerability affects the WordPress plugin ecosystem. The LadiApp plugin is distributed via the official WordPress plugin repository. Users are advised to monitor for updates from the vendor (Ladiapp) and consider disabling the plugin if no patch is available. No open-source patch data or GitHub advisory context is available at this time.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires subscriber-level authentication
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L) – unauthorized modification of data
• Availability Impact: None (A:N)

Threat Level: Medium. While the CVSS score is moderate, the ability to create pages with stored XSS can lead to further compromise of higher-privileged users (e.g., administrators) if they view the malicious pages.

Deep Dive & Mechanics

The vulnerability exists in the publish_lp() function of the LadiApp plugin. This function is registered as an AJAX action for authenticated users. The code fails to perform a capability check (e.g., current_user_can('edit_posts')) before processing the request. As a result, any authenticated user, including those with subscriber-level access, can call this function.

The function allows an attacker to set the LadiPage key to an arbitrary value. This key is used to create and manage pages within the plugin. By controlling the key, an attacker can:

1. Create new pages with arbitrary content.
2. Inject malicious JavaScript into page content, leading to stored XSS.
3. Potentially escalate privileges if an administrator views the crafted page.

The attack flow:

1. Attacker authenticates with subscriber-level credentials.
2. Attacker sends an AJAX request to admin-ajax.php with the action publish_lp and a crafted payload containing a new LadiPage key and malicious page content.
3. The plugin processes the request without checking capabilities, creating a new page with the attacker-controlled content.
4. When an administrator or other user visits the page, the stored XSS executes.

Vulnerable vs. Patched Code

Vulnerable Code (<= 4.4):

add_action('wp_ajax_publish_lp', 'publish_lp');
function publish_lp() {
    // No capability check
    $key = $_POST['key'];
    $content = $_POST['content'];
    // ... process and save page
}

Patched Code (Hypothetical):

add_action('wp_ajax_publish_lp', 'publish_lp');
function publish_lp() {
    if (!current_user_can('edit_posts')) {
        wp_die('Unauthorized');
    }
    $key = sanitize_text_field($_POST['key']);
    $content = wp_kses_post($_POST['content']);
    // ... process and save page
}

The patch would add a capability check using current_user_can('edit_posts') and sanitize inputs to prevent XSS.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with LadiApp plugin <= 4.4
• Subscriber-level account credentials

Exploitation Steps:

1. Log in as a subscriber.
2. Craft an AJAX request to create a malicious page:

// Using browser console or curl
var data = {
    action: 'publish_lp',
    key: 'attacker_controlled_key',
    content: '<script>alert("XSS")</script>'
};
jQuery.post(ajaxurl, data, function(response) {
    console.log('Page created:', response);
});

3. The attacker can then share the page URL with an administrator to trigger the XSS.

Curl Example:

curl -X POST http://target/wp-admin/admin-ajax.php \
  -c cookies.txt -b cookies.txt \
  -d "action=publish_lp&key=evil_key&content=<script>alert('XSS')</script>"

Blue Team

Detection Steps:

1. Monitor AJAX requests to admin-ajax.php with action publish_lp from low-privileged users.
2. Review LadiApp pages for unexpected content or scripts.
3. Check for unusual LadiPage keys in the database.

Honeypot:

• Create a fake subscriber account and monitor its AJAX activity.
• Log all publish_lp requests for analysis.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /wp-admin/admin-ajax.php with action=publish_lp
  • Unusual key parameters in AJAX requests
• File System:
  • Unexpected pages in the LadiApp plugin directory
  • Modified database entries in wp_postmeta with LadiApp keys
• Logs:
  • WordPress debug logs showing publish_lp calls from subscriber users
  • Web server logs with admin-ajax.php POST requests from non-admin IPs

Detection Engineering

YARA Rule

rule CVE_2023_4728_LadiApp_Missing_Auth {
    meta:
        description = "Detects exploitation attempts for CVE-2023-4728 in LadiApp plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-4728"
    strings:
        $ajax_action = "publish_lp"
        $plugin_path = "wp-content/plugins/ladipage"
        $xss_payload = /<script[^>]*>.*<\/script>/i
    condition:
        $ajax_action and $plugin_path and #xss_payload > 0
}

Sigma Rule

title: CVE-2023-4728 LadiApp Missing Authorization Exploitation
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects AJAX requests to publish_lp action from low-privileged users
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri: '/wp-admin/admin-ajax.php'
        cs-uri-query: 'action=publish_lp'
    condition: selection
falsepositives:
    - Legitimate admin activity (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2023-4728 LadiApp Missing Authorization Exploitation";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=publish_lp"; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the LadiApp plugin until a patch is released.
2. Restrict user roles – ensure only trusted users have subscriber-level access.
3. Implement Web Application Firewall (WAF) rules to block publish_lp AJAX requests from non-admin users.

Long-term Fix:

• The vendor (Ladiapp) must release a patched version that adds capability checks and input sanitization.
• Users should update to the latest version once available.

Workaround:

• Add a custom capability check via a WordPress plugin or theme functions.php:

add_action('wp_ajax_publish_lp', 'custom_publish_lp_check', 1);
function custom_publish_lp_check() {
    if (!current_user_can('edit_posts')) {
        wp_die('Unauthorized');
    }
}

Valters IT
Securing Digital Frontiers