NASA — Hidden Login Page Bypass via auth_redirect + 403 Bypass (CVE-2023–5089)

Defender Security versions prior to 4.1.0 fail to properly restrict access to the WordPress login page when the Hide Login Page feature is enabled. By abusing the auth_redirect function (CVE-2023–5089), an unauthenticated attacker can trigger a redirect to the login endpoint and bypass the initial HTTP 403 restriction via URL path manipulation, gaining access to the WordPress login page.

This issue constitutes a Broken Access Control vulnerability, as unauthenticated users can bypass enforced access restrictions and interact with a fully restricted authentication endpoint, resulting in an implicit privilege escalation and enabling further attacks such as brute force, credential stuffing, and user enumeration.

Trigger auth_redirect (CVE-2023–5089)

The application triggers a redirect to the WordPress login endpoint via auth_redirect.

Target:https://partnerships.gsfc.nasa.gov/?gf_page=randomstring

The initial HTTP request is performed, which triggers an automatic redirection to a protected resource.

The redirection is followed to the authentication endpoint, which is expected to display the login interface; however, due to the configured access restrictions, this resource should not be accessible or visible to unauthenticated users.

Step 2 — Login Page Access Blocked (403)

The identified condition is validated by reproducing it directly within a web browser.

Redirected URL: https://partnerships.gsfc.nasa.gov/code102/?redirect_to=https%3A%2F%2Fpartnerships.gsfc.nasa.gov%2F%3Fgf_page%3Drandomstring&reauth=1

Result:

• 403 restriction is bypassed
• WordPress login page becomes accessible

By manipulating the URL through GET parameters, it is possible to access and display the WordPress login interface, effectively bypassing the previously configured access restrictions.

Next, the same HTTP 403 (Forbidden) bypass technique is tested to validate authentication credentials.

The HTTP request is captured in order to apply the required URL manipulation to bypass the 403 (Forbidden) response.

Finally, the bypass is successful, as the application processes the credential validation mechanism even when the supplied credentials are not valid.

The combination of:

1. auth_redirect abuse (CVE-2023-5089)
2. URL Path Manipulation

allows an unauthenticated attacker to fully bypass the hidden login protection.