CVE-2023-6812

Executive Summary

CVE-2023-6812 is an open redirect vulnerability found in the WP Compress – Image Optimizer [All-In-One] plugin for WordPress, affecting all versions up to and including 6.20.01. The flaw resides in insufficient validation of the redirect URL supplied via the css parameter, allowing unauthenticated attackers to redirect users to malicious external sites through social engineering. The vulnerability has a CVSS score of 4.3 (Medium) and a very low EPSS score (0.0%), indicating low exploitation likelihood in the wild. No public exploit code or patch details are currently available.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The threat level is considered low due to the requirement for user interaction and the limited impact (redirect only). However, the vulnerability can be chained with phishing campaigns to increase credibility.

Deep Dive & Mechanics

The WP Compress plugin processes a css parameter to handle dynamic CSS loading. Due to insufficient validation, an attacker can supply a malicious URL as the value of this parameter. When a user is tricked into clicking a crafted link (e.g., https://victim-site.com/?css=https://evil.com), the plugin will redirect the user to the attacker-controlled site. This is a classic open redirect (CWE-601) that can be used for phishing, credential harvesting, or malware distribution.

The vulnerability is unauthenticated, meaning no login is required to trigger the redirect. The plugin does not sanitize or validate the redirect destination, allowing arbitrary URLs.

Vulnerable vs. Patched Code

Vulnerable Code (simplified):

$redirect_url = $_GET['css'];
if (!empty($redirect_url)) {
    wp_redirect($redirect_url);
    exit;
}

Patched Code (expected):

$redirect_url = $_GET['css'];
if (!empty($redirect_url) && wp_http_validate_url($redirect_url) && strpos($redirect_url, home_url()) === 0) {
    wp_redirect($redirect_url);
    exit;
}

The patched version would validate that the URL is a valid HTTP URL and that it belongs to the same site (or a whitelist of allowed domains). Since no official patch is available, users must manually apply such validation.

Exploitation & Lab Setup

Red Team

1. Craft the malicious URL:

   https://victim-site.com/?css=https://attacker-controlled.com/phishing-page
   

2. Deliver via phishing email or social media: Trick the user into clicking the link.
3. User clicks: The plugin redirects the user to the attacker's site, where a fake login page or malware download is presented.

No exploit code is publicly available.

Blue Team

1. Monitor for unusual css parameter values: Look for external domains in the css parameter.
2. Block external redirects: Use a Web Application Firewall (WAF) to block redirects to external domains.
3. User awareness training: Educate users to verify URLs before clicking.

Indicators of Compromise (IOCs)

• URL Pattern: ?css=https:// or ?css=http:// followed by an external domain.
• Referer Header: Requests to external domains originating from the WordPress site.
• Log Entries: wp_redirect() calls with external URLs in the css parameter.

Detection Engineering

YARA Rule

rule CVE_2023_6812_Open_Redirect {
    meta:
        description = "Detects open redirect attempts via WP Compress css parameter"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-6812"
    strings:
        $param = "css=" nocase
        $redirect = "wp_redirect" nocase
    condition:
        $param and $redirect
}

Sigma Rule

title: WP Compress Open Redirect via css Parameter
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects open redirect attempts using the css parameter in WP Compress plugin
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-6812
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: "css=http"
    condition: selection
falsepositives:
    - Legitimate use of external CSS (rare)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-6812 WP Compress Open Redirect"; flow:to_server,established; content:"css="; http_uri; content:"http"; http_uri; distance:0; within:100; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable the WP Compress plugin until a patch is released.
2. Workaround: Add a custom filter to validate the css parameter:

   add_filter('wp_compress_redirect_url', function($url) {
       if (strpos($url, home_url()) !== 0) {
           return home_url();
       }
       return $url;
   });
   

3. Long-term: Monitor the plugin's official repository for a security update and apply it immediately.
4. WAF Rule: Block requests containing css=http or css=https in the query string.

Valters IT signature