CVE-2023-7199

Executive Summary

CVE-2023-7199 is a critical authorization bypass vulnerability in the WordPress ecosystem, specifically affecting the Relevanssi and Relevanssi Premium plugins. The flaw allows any unauthenticated attacker to read draft and private posts by sending a crafted request. This is a classic Insecure Direct Object Reference (IDOR) issue, where the plugin fails to properly verify user permissions before returning search results containing non-public content. The vulnerability has a CVSS score of 7.5 (High) due to its low attack complexity and network-based vector, requiring no authentication or user interaction. Given the widespread use of Relevanssi for site search, this poses a significant data leakage risk for WordPress sites running vulnerable versions.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The Relevanssi plugin is distributed via the official WordPress Plugin Directory and its premium counterpart. Users are advised to update directly from their WordPress admin dashboard or by downloading the latest version from the plugin's official source. No third-party package managers (NPM, PyPI, Go, Ruby) are involved.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions or complex steps are required.
• Privileges Required (PR): None – No authentication is needed.
• User Interaction (UI): None – The victim does not need to perform any action.
• Scope (S): Unchanged – The exploit does not affect other components.
• Confidentiality (C): High – Sensitive draft and private posts can be read.
• Integrity (I): None – Data cannot be modified.
• Availability (A): None – Service availability is not impacted.

Threat Level: High. The ease of exploitation and the potential for mass data leakage make this a priority for patching.

Deep Dive & Mechanics

The Relevanssi plugin enhances WordPress search functionality. The vulnerability lies in how the plugin handles search queries when returning results. Specifically, the plugin fails to check the post_status of a post against the current user's capabilities before including it in search results.

In a normal WordPress search, the system checks if the current user can read a post based on its status (e.g., publish, draft, private). Relevanssi, when indexing and searching, bypasses this check for certain crafted requests. An attacker can send a search request with specific parameters (e.g., manipulating the s parameter or using a direct query to the Relevanssi search endpoint) that forces the plugin to return posts regardless of their status.

The core issue is a missing or insufficient capability check in the search results filtering logic. The plugin likely uses WP_Query but does not properly set the post_status parameter to respect user permissions, or it uses a custom database query that ignores the WordPress permission system.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual): The vulnerable version likely contains a search handler that does not filter by post_status based on user capabilities. For example:

// Vulnerable: No permission check
function relevanssi_search($query) {
    // ... build search query ...
    $results = $wpdb->get_results("SELECT ID FROM {$wpdb->posts} WHERE ...");
    // Returns all matching posts, including drafts and private
    return $results;
}

Patched Code (Conceptual): The patched version adds a capability check, ensuring only posts the current user can read are returned.

// Patched: Permission check added
function relevanssi_search($query) {
    // ... build search query ...
    $post_statuses = array('publish');
    if (is_user_logged_in()) {
        $user = wp_get_current_user();
        if ($user->has_cap('read_private_posts')) {
            $post_statuses[] = 'private';
        }
        if ($user->has_cap('edit_posts')) {
            $post_statuses[] = 'draft';
        }
    }
    $status_placeholders = implode(',', array_fill(0, count($post_statuses), '%s'));
    $results = $wpdb->get_results($wpdb->prepare("SELECT ID FROM {$wpdb->posts} WHERE post_status IN ($status_placeholders) AND ...", $post_statuses));
    return $results;
}

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Setup:

1. Install a vulnerable WordPress instance (e.g., using Docker: docker run --name wp-vuln -e WORDPRESS_DB_HOST=db -e WORDPRESS_DB_USER=wordpress -e WORDPRESS_DB_PASSWORD=wordpress -e WORDPRESS_DB_NAME=wordpress -p 8080:80 -d wordpress:latest).
2. Install Relevanssi plugin version 4.21.0 (or any version < 4.22.0).
3. Create a draft post and a private post.
4. Ensure the Relevanssi search is active and indexing.

Exploit Steps:

1. Identify the target WordPress site running the vulnerable plugin.
2. Send a crafted GET request to the search endpoint. The exact parameter may vary, but a common approach is to manipulate the s parameter or use a direct AJAX call to admin-ajax.php with a Relevanssi action.

Example request using curl:

curl -v "http://target-site.com/?s=test&relevanssi=1"

If the plugin has an AJAX endpoint, you might use:

curl -v "http://target-site.com/wp-admin/admin-ajax.php?action=relevanssi_live_search&q=test"

3. Analyze the response. If the response contains content from draft or private posts, the site is vulnerable.

Automated Exploitation: Use a script to iterate through common search terms and extract non-public content.

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual search queries that return a high number of results or contain keywords typically found in draft/private posts.
• Look for requests to admin-ajax.php with action=relevanssi_live_search from unauthenticated users.
• Check for anomalies in the s parameter or other Relevanssi-specific parameters.

Defense:

• Immediately update the Relevanssi plugin to version 4.22.0 or higher (Premium to 2.25.0).
• Implement a Web Application Firewall (WAF) rule to block requests with suspicious Relevanssi parameters from unauthenticated users.
• Restrict access to admin-ajax.php for unauthenticated users where possible.
• Regularly audit plugin versions and apply security patches.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /?s=<search_term>&relevanssi=1 from unauthenticated IPs.
  • HTTP requests to /wp-admin/admin-ajax.php?action=relevanssi_live_search&q=<search_term> from unauthenticated IPs.
  • Unusual spikes in search result sizes or response times.
• File IOCs:
  • Presence of Relevanssi plugin version < 4.22.0 (or Premium < 2.25.0) in /wp-content/plugins/relevanssi/.
• Log IOCs:
  • Web server logs showing repeated search queries from the same IP without a valid session cookie.
  • WordPress debug logs showing errors related to post_status or permission checks.

Detection Engineering

YARA Rule

rule Detect_Vulnerable_Relevanssi_Plugin {
    meta:
        description = "Detects vulnerable versions of Relevanssi WordPress plugin (CVE-2023-7199)"
        author = "Valters IT"
        date = "2024-01-01"
        hash = "d41d8cd98f00b204e9800998ecf8427e"
    strings:
        $version_string = "Version: 4." ascii wide nocase
        $plugin_header = "Plugin Name: Relevanssi" ascii wide nocase
    condition:
        $plugin_header and $version_string and (uint16(0) == 0x4D5A or uint32(0) == 0x464c457f)
}

Sigma Rule

title: Detect Exploitation of CVE-2023-7199 - Relevanssi Unauthenticated Draft/Private Post Read
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects unauthenticated requests to Relevanssi search endpoints that may indicate exploitation of CVE-2023-7199.
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
    service: accesslog
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - 'relevanssi=1'
            - 'action=relevanssi_live_search'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate search requests from authenticated users (check for session cookies)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-7199 Relevanssi Unauthenticated Draft/Private Post Read"; flow:to_server,established; content:"GET"; http_method; content:"relevanssi=1"; http_uri; nocase; content:"!Cookie"; http_header; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update the Plugin: Upgrade Relevanssi to version 4.22.0 or higher (Premium to 2.25.0) immediately.
2. Verify Update: Confirm the update by checking the plugin version in the WordPress admin dashboard or via wp plugin list.
3. Audit Logs: Review web server and WordPress logs for any signs of exploitation.

Long-Term Mitigations:

• Implement a Content Security Policy (CSP) to restrict data exfiltration.
• Use a WAF with rules to block unauthenticated access to plugin-specific endpoints.
• Regularly update all WordPress plugins, themes, and core.
• Conduct periodic security audits and penetration testing.
• Monitor for new CVEs related to WordPress plugins and apply patches promptly.

Workaround (if patching is not immediately possible):

• Disable the Relevanssi plugin temporarily and use the default WordPress search.
• Restrict access to admin-ajax.php using .htaccess rules for unauthenticated users:

<Files "admin-ajax.php">
    Require all denied
    Require ip 127.0.0.1
</Files>

(Note: This may break legitimate AJAX functionality for unauthenticated users.)

Valters IT