CVE-2024-0660

Executive Summary

CVE-2024-0660 is a Cross-Site Request Forgery (CSRF) vulnerability in the Formidable Forms WordPress plugin (by Strategy11), affecting all versions up to and including 6.7.2. The vulnerability exists in the update_settings function due to missing or incorrect nonce validation. An unauthenticated attacker can forge a request to change form settings and inject malicious JavaScript, provided they can trick a site administrator into clicking a crafted link. This can lead to persistent XSS, data theft, or further compromise of the WordPress site.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users who installed the plugin from the repository or via automatic updates are affected. No third-party package manager (NPM, PyPI, etc.) is involved.

CVSS Breakdown & Threat Level

• CVSS Score: 6.1 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – the attacker must trick an admin into clicking a link.
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L) – limited data exposure.
• Integrity Impact: High (I:H) – attacker can modify form settings and inject scripts.
• Availability Impact: None (A:N)

Threat Level: Medium. Exploitation requires social engineering, but the impact on integrity is high, allowing persistent XSS.

Deep Dive & Mechanics

The vulnerability resides in the update_settings function of the Formidable Forms plugin. This function is responsible for saving plugin settings, including form configurations. The function lacks proper nonce validation, meaning it does not verify that the request originated from the legitimate admin interface. An attacker can craft a malicious link or form that, when clicked by an authenticated administrator, will execute a forged request to update_settings. This can change form settings (e.g., redirect URLs, email recipients) or inject malicious JavaScript into form fields, leading to stored XSS.

Attack Flow:

1. Attacker crafts a URL like: http://target.com/wp-admin/admin-ajax.php?action=frm_settings_update&...
2. Attacker sends this link to an admin via email, social media, etc.
3. Admin clicks the link while logged into WordPress.
4. The forged request executes, modifying plugin settings or injecting JavaScript.
5. The injected script executes when other users view the affected forms.

Vulnerable vs. Patched Code

Vulnerable Code (<= 6.7.2):

public function update_settings() {
    // Missing nonce check
    $settings = $_POST['frm_settings'];
    update_option('frm_options', $settings);
}

Patched Code (hypothetical fix):

public function update_settings() {
    if ( ! isset( $_POST['_wpnonce'] ) || ! wp_verify_nonce( $_POST['_wpnonce'], 'frm_update_settings' ) ) {
        wp_die( 'Security check failed.' );
    }
    $settings = $_POST['frm_settings'];
    update_option('frm_options', $settings);
}

The patch adds a nonce verification using wp_verify_nonce() before processing the request.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with Formidable Forms <= 6.7.2.
• An authenticated admin session (the victim).

Exploit Steps:

1. Identify the target WordPress site.
2. Craft a malicious HTML page or link that sends a POST request to wp-admin/admin-ajax.php with the action frm_settings_update and malicious payload.
3. Deliver the link to the admin (e.g., via phishing email).
4. When the admin clicks, the settings are modified.

Example Malicious HTML:

<html>
<body>
<form action="http://target.com/wp-admin/admin-ajax.php" method="POST">
    <input type="hidden" name="action" value="frm_settings_update">
    <input type="hidden" name="frm_settings[malicious]" value="<script>alert('XSS')</script>">
    <input type="submit" value="Click me">
</form>
<script>document.forms[0].submit();</script>
</body>
</html>

Blue Team

Detection:

• Monitor for unusual POST requests to admin-ajax.php with action frm_settings_update from unauthenticated or unexpected IPs.
• Look for changes in plugin settings without corresponding admin UI activity.
• Use the Sigma rule below to detect CSRF attempts.

Mitigation:

• Apply the vendor patch when available.
• Implement CSRF tokens (nonces) for all admin actions.
• Use Web Application Firewall (WAF) rules to block requests missing nonce parameters.

Indicators of Compromise (IOCs)

• Network: POST requests to /wp-admin/admin-ajax.php with action=frm_settings_update and no _wpnonce parameter.
• File: Modified wp_options table with frm_options containing unexpected JavaScript.
• Log: WordPress debug log entries showing failed nonce checks (if logging enabled).
• Behavior: Sudden appearance of JavaScript alerts or redirects on form pages.

Detection Engineering

YARA Rule

rule CVE_2024_0660_CSRF {
    meta:
        description = "Detects CSRF attempts against Formidable Forms update_settings"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-0660"
    strings:
        $action = "frm_settings_update"
        $nonce_missing = "frm_settings" ascii wide nocase
    condition:
        $action and not $nonce_missing
}

Sigma Rule

title: CVE-2024-0660 - Formidable Forms CSRF Attempt
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects POST requests to admin-ajax.php with frm_settings_update action without nonce
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-0660
tags:
    - attack.t1190
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: "admin-ajax.php"
        cs-uri-query|contains: "action=frm_settings_update"
    filter:
        cs-uri-query|contains: "_wpnonce"
    condition: selection and not filter
falsepositives:
    - Legitimate admin actions with nonce (should be filtered)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-0660 - Formidable Forms CSRF Attempt"; flow:to_server; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action=frm_settings_update"; http_uri; pcre:"/^(?!.*_wpnonce).*$/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the Formidable Forms plugin until a patch is applied.
2. Short-term: Implement a Web Application Firewall (WAF) rule to block requests to admin-ajax.php with action=frm_settings_update that lack a valid nonce.
3. Long-term: Apply the vendor patch when released. Ensure all WordPress plugins are updated regularly.
4. User Education: Train administrators to avoid clicking suspicious links, especially when logged into WordPress.

Valters IT – Securing digital frontiers, one CVE at a time.