CVE-2023-6600: Unauthorized Data Modification and Stored Cross-Site Scripting in OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. WordPress Plugin

Overview

The CVE-2023-6600 is a critical vulnerability identified in the OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. plugin for WordPress. This vulnerability could potentially allow an unauthenticated attacker to modify the plugin’s settings or inject Cross-Site Scripting (XSS) payloads, leading to unauthorized data modification or even complete directory deletion.
The vulnerability has gained significant attention due to its high severity score and the wide usage of the affected WordPress plugin. It is therefore crucial for users, developers, and system administrators to understand the risks and apply the appropriate mitigation measures.

Vulnerability Summary

CVE ID: CVE-2023-6600
Severity: Critical, CVSS v3 Score: 8.6
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: Unauthorized data modification, Stored Cross-Site Scripting, potential system compromise or data leakage

Affected Products

Product | Affected Versions

OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. WordPress Plugin | Up to and including 5.7.9

How the Exploit Works

The vulnerability stems from a missing capability check on the update_settings() function hooked via admin_init. This allows a malicious attacker to exploit the vulnerability by sending a specially crafted HTTP request to the server, causing the server to update the plugin’s settings. These modified settings can then be used by the attacker to inject Cross-Site Scripting payloads or delete entire directories.

Conceptual Example Code

Here is a hypothetical example of how the vulnerability might be exploited:

POST /wp-admin/admin-ajax.php?action=omgf_optimize HTTP/1.1
Host: target.example.com
Content-Type: application/json
{
"settings": {
"cdn_url": "http://malicious.example.com",
"force_subsets": "<img src=x onerror=alert('XSS') />",
"remove_existing": "true"
}
}

In this example, the attacker sends a POST request to the vulnerable endpoint with a payload that modifies the plugin’s settings to inject a Cross-Site Scripting attack and remove existing directories.