CVE-2021-24355 : What You Need to Know

WordPress plugin Simple 301 Redirects by BetterLinks before version 2.0.4 is vulnerable to unauthorized access due to a lack of capability checks and insufficient nonce validation in specific AJAX actions.

Understanding CVE-2021-24355

This CVE concerns a security vulnerability in the Simple 301 Redirects by BetterLinks WordPress plugin that allows authenticated users to retrieve and update wildcard values for redirects.

What is CVE-2021-24355?

In Simple 301 Redirects by BetterLinks plugin before version 2.0.4, the absence of proper capability checks and inadequate nonce verification in certain AJAX actions facilitated authenticated users to access and modify the wildcard value for redirects.

The Impact of CVE-2021-24355

The vulnerability in versions prior to 2.0.4 enabled attackers with authenticated user privileges to potentially manipulate redirection rules and URLs, compromising website integrity and redirect traffic.

Technical Details of CVE-2021-24355

The technical details include vulnerability description, affected systems and versions, and exploitation mechanism.

Vulnerability Description

The security flaw arises from the absence of strict authorization controls and insufficient nonce checks, allowing unauthorized users with authenticated access to interact with critical plugin functions.

Affected Systems and Versions

Versions of Simple 301 Redirects by BetterLinks ranging from 2.0.0 to 2.0.3 are impacted by this vulnerability, with version 2.0.4 addressing the issue.

Exploitation Mechanism

By leveraging the inadequate access controls and nonce validation in the plugin's AJAX actions, attackers could potentially manipulate wildcard values for redirects.

Mitigation and Prevention

To secure systems against CVE-2021-24355, immediate steps, long-term security practices, and patching instructions should be followed.

Immediate Steps to Take

Users are advised to update the Simple 301 Redirects by BetterLinks plugin to version 2.0.4 or later to mitigate the vulnerability and enhance security.

Long-Term Security Practices

Implement robust access controls, regular security audits, and user permissions reviews to prevent unauthorized access and bolster overall website security.

Patching and Updates

Regularly check for plugin updates and security patches, and promptly apply them to ensure the latest fixes are in place to protect against known vulnerabilities.