CVE-2023-45110 - Missing Authorization Vulnerability in BoldThemes Bold Timeline Lite**: Exploiting Incorrectly Configured Access Control Security Levels

Today we're going to discuss a recently discovered vulnerability that has a massive security impact on a popular WordPress plugin called Bold Timeline Lite, which is created by BoldThemes. The vulnerability is classified as *CVE-2023-45110*, and it consists of a missing authorization check that could allow attackers to exploit and access protected data. This security flaw affects all Bold Timeline Lite versions, from n/a to 1.1.9.

Background

Before diving into the vulnerability details, it's important to understand the context and importance of this plugin. Bold Timeline Lite is a WordPress plugin that adds a visually appealing and interactive timeline to your website, and it also allows users to create or modify events on this timeline easily. Nowadays, Bold Timeline Lite is widely used by various companies and organizations to showcase their historical events and milestones on their websites.

Vulnerability Details

This security flaw is caused by missing or incorrectly configured access control security levels within the plugin, which allows unauthorized users to perform certain actions that should have been restricted to only authorized users.

To understand the vulnerability and its potential impact, let's consider a code snippet from the plugin:

function bold_timeline_import_sample_data() {
    global $wpdb;
    $file = plugin_dir_path( __FILE__ ) . 'samples/sample_data.sql';
    if ( file_exists( $file ) ) {
        $content = file_get_contents( $file );
        $wpdb->query( "START TRANSACTION" );
        $wpdb->query( "SET autocommit=" );
        $content = preg_replace( "/(?:--[\s\S]*?\n|/\*[\s\S]*?\*/)/", "", $content );            
        $content = $wpdb->escape( $content );
        $replace = array( 'INSERT', 'UPDATE', 'DELETE' );
        $with    = array( $wpdb->prefix . 'INSERT', $wpdb->prefix . 'UPDATE', $wpdb->prefix . 'DELETE' );
        $content = str_replace( $replace, $with, $content );
        $wpdb->query( $content );
        $wpdb->query( "COMMIT" );
        wp_send_json_success( __( 'Sample data has been imported successfully!', 'bold-timeline' ) );
    } else {
        wp_send_json_error( __( 'Sample data file is missing!', 'bold-timeline' ) );
    }
}

As the code above shows, the bold_timeline_import_sample_data() function is responsible for importing the sample data into the database. However, it lacks any access control restrictions (e.g., checking if the user is an administrator) before executing the function. An attacker could exploit this vulnerability by calling the function remotely and bypassing the intended access control.

Find a vulnerable website using the Bold Timeline Lite plugin.

2. Craft a malicious POST request to the target website, such as: https://targetwebsite.com/wp-admin/admin-ajax.php?action=bold_timeline_import_sample_data
3. Once a malicious request has been sent, the function will be executed and the sample data would be imported into the target website's database.

How to mitigate

To mitigate this vulnerability, the plugin developers should implement proper access control checks before executing any critical function. This can be done by checking the user's role or capabilities before allowing them to perform sensitive actions. For instance, they can use the current_user_can() function, which checks if the current user has a specific capability:

function bold_timeline_import_sample_data() {
    if (!current_user_can('manage_options')) {
        wp_send_json_error(__('You do not have sufficient permissions to perform this action!', 'bold-timeline'));
        return;
    }
    
    // Rest of the function...
}

In this example, only users with the 'manage_options' capability (usually administrators) can perform the sample data import action.

Original References

CVE-2023-45110: NVD
BoldTimeline Lite: Official Plugin Page

Conclusion

In this post, we have taken a look at a critical security flaw (CVE-2023-45110) that affects Bold Timeline Lite, a widely-used WordPress plugin. To avoid this vulnerability, developers must implement proper access control checks in their code. Additionally, it's crucial for site owners to keep their plugins updated and be aware of potential vulnerabilities like this one.

Timeline

Published on: 01/02/2025 12:15:08 UTC