CVE-2023-47761

Executive Summary

CVE-2023-47761 is a Missing Authorization vulnerability in the WordPress plugin Simple 301 Redirects by BetterLinks, developed by WPDeveloper. This flaw allows an authenticated attacker with low privileges (e.g., a subscriber or contributor) to exploit incorrectly configured access control security levels. The vulnerability affects all versions up to and including 2.0.7. The CVSS score is 4.3 (Medium), and the EPSS probability is 0.0%, indicating a low exploitation likelihood in the wild. No public proof-of-concept (PoC) or exploit code has been released, and no patch is currently available.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository. The plugin is not available on NPM, PyPI, Go, or Ruby ecosystems. The risk is primarily to WordPress site administrators who have installed this plugin. Since no patch is available, users must rely on alternative mitigations such as disabling the plugin or implementing custom access controls.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – An attacker needs a low-privilege account (e.g., subscriber).
• User Interaction (UI): None (N) – No user action is needed.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality Impact (C): None (N) – No data confidentiality is compromised.
• Integrity Impact (I): Low (L) – The attacker can modify redirect rules, potentially leading to phishing or redirection to malicious sites.
• Availability Impact (A): None (N) – No denial of service.

Threat Level: Medium. The low privileges required and network attack vector make this a viable target for attackers with access to a low-privilege account.

Deep Dive & Mechanics

The vulnerability stems from a Missing Authorization check (CWE-862) in the plugin's REST API or AJAX handlers. The plugin likely exposes endpoints for creating, modifying, or deleting redirect rules without verifying that the current user has the appropriate capabilities (e.g., manage_options or edit_posts). This allows any authenticated user, regardless of role, to manipulate redirect rules.

Attack Scenario:

1. An attacker gains access to a low-privilege account (e.g., via credential stuffing or social engineering).
2. The attacker sends a crafted HTTP request to the vulnerable endpoint (e.g., /wp-json/simple-301-redirects/v1/redirects).
3. The request modifies or creates a redirect rule pointing to a malicious external site.
4. Legitimate users visiting the targeted URL are redirected to the attacker-controlled site, enabling phishing, malware distribution, or SEO spam.

Root Cause: The plugin fails to call current_user_can() or similar capability checks before processing requests that modify redirect rules.

Vulnerable vs. Patched Code

Since no patch is available, we can only analyze the vulnerable code pattern. The vulnerable code likely resembles:

// Vulnerable code (simplified)
add_action('wp_ajax_simple_301_redirects_save', 'save_redirect_rule');
function save_redirect_rule() {
    // No capability check
    $rule = $_POST['rule'];
    update_option('simple_301_redirects_rules', $rule);
    wp_die();
}

A patched version would include a capability check:

// Patched code (simplified)
add_action('wp_ajax_simple_301_redirects_save', 'save_redirect_rule');
function save_redirect_rule() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    $rule = $_POST['rule'];
    update_option('simple_301_redirects_rules', $rule);
    wp_die();
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with Simple 301 Redirects <= 2.0.7 installed and activated.
• A low-privilege user account (e.g., subscriber).

Exploitation Steps:

1. Log in as the low-privilege user.
2. Identify the vulnerable endpoint. Common endpoints include:
   • /wp-admin/admin-ajax.php?action=simple_301_redirects_save
   • /wp-json/simple-301-redirects/v1/redirects
3. Send a POST request to create a malicious redirect:

curl -X POST https://target.com/wp-admin/admin-ajax.php \
  -d "action=simple_301_redirects_save&rule[source]=/old-page&rule[target]=https://evil.com/phishing"

4. Verify the redirect by visiting /old-page on the target site.

Blue Team

Detection Steps:

1. Monitor for unusual AJAX requests to admin-ajax.php with the action parameter containing simple_301_redirects.
2. Review user roles and capabilities; ensure only administrators have access to redirect management.
3. Check for unexpected redirect rules in the WordPress options table:

SELECT * FROM wp_options WHERE option_name = 'simple_301_redirects_rules';

4. Implement a Web Application Firewall (WAF) rule to block requests to the vulnerable endpoint from non-admin users.

Indicators of Compromise (IOCs)

• File Indicators:

  • Modified wp_options table with option_name = 'simple_301_redirects_rules' containing unexpected redirect entries.
  • Presence of the plugin file /wp-content/plugins/simple-301-redirects/ (version <= 2.0.7).

• Network Indicators:

  • HTTP POST requests to /wp-admin/admin-ajax.php with action=simple_301_redirects_save.
  • HTTP requests to /wp-json/simple-301-redirects/v1/redirects from low-privilege users.

• Log Indicators:

  • WordPress debug log entries showing unauthorized access attempts to redirect management endpoints.
  • Web server logs showing 403 errors followed by successful 200 responses from the same IP.

Detection Engineering

YARA Rule

rule CVE_2023_47761_Simple_301_Redirects {
    meta:
        description = "Detects exploitation attempts of CVE-2023-47761 in Simple 301 Redirects plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-47761"
    strings:
        $ajax_action = "simple_301_redirects_save"
        $rest_endpoint = "/simple-301-redirects/v1/redirects"
        $wp_option = "simple_301_redirects_rules"
    condition:
        any of them
}

Sigma Rule

title: CVE-2023-47761 - Missing Authorization in Simple 301 Redirects
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthorized access to Simple 301 Redirects plugin endpoints
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains:
            - 'action=simple_301_redirects_save'
            - '/simple-301-redirects/v1/redirects'
    condition: selection
falsepositives:
    - Legitimate admin actions
level: medium

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2023-47761 - Simple 301 Redirects Missing Authorization Exploit";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"simple_301_redirects_save";
    http_client_body;
    sid:1000001;
    rev:1;
    reference:cve,2023-47761;
    classtype:attempted-admin;
    priority:2;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not essential for business operations.
2. Restrict user roles – Ensure only trusted administrators have accounts with any access to the site.
3. Implement a WAF rule to block requests to the vulnerable endpoints from non-admin IPs.

Long-term Fix:

• Monitor the WPDeveloper repository for a patched version (>= 2.0.8). Once available, update immediately.
• If the plugin is critical, consider forking and adding the missing capability checks manually.

Workaround:

• Add a custom function to your theme's functions.php to enforce capability checks:

add_action('wp_ajax_simple_301_redirects_save', 'custom_capability_check', 1);
function custom_capability_check() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
}

Valters IT
Securing Digital Frontiers