CVE-2024-10521

Executive Summary

CVE-2024-10521 is a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress Contact Forms by Cimatti plugin, affecting all versions up to and including 1.9.2. The vulnerability exists due to missing or incorrect nonce validation on the process_bulk_action function, allowing an unauthenticated attacker to delete forms by tricking a site administrator into performing an action such as clicking a malicious link. The CVSS score is 4.3 (Medium), with an EPSS score of 0.0%, indicating low exploitation likelihood at this time. No public proof-of-concept (PoC) or exploit code has been released. As this is a WordPress plugin vulnerability, it is treated as a WordPress ecosystem issue.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should verify the integrity of the plugin by checking the plugin's checksum against the official repository. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability requires user interaction (admin clicking a link) and only allows deletion of forms, not data exfiltration or full compromise.

Deep Dive & Mechanics

The vulnerability resides in the process_bulk_action function within the plugin's admin interface. This function handles bulk actions (e.g., deleting multiple forms) from the WordPress admin panel. The function lacks proper nonce validation, meaning it does not verify that the request originated from the legitimate admin user session. An attacker can craft a malicious link or form that, when clicked by an authenticated administrator, triggers a forged request to delete forms. The request is processed without CSRF protection, leading to unauthorized form deletion.

Root Cause: Missing or incorrect nonce validation on the process_bulk_action function.

Attack Flow:

1. Attacker crafts a malicious HTML page or email containing a link like:

   http://target-site.com/wp-admin/admin.php?page=cimatti-contact-forms&action=delete&form_id=123
   

2. Attacker tricks an authenticated WordPress admin into clicking the link.
3. The admin's browser sends the request with their session cookies.
4. The plugin processes the request without checking a nonce, deleting the specified form.

Vulnerable vs. Patched Code

Vulnerable Code (<= 1.9.2):

function process_bulk_action() {
    // No nonce check
    if (isset($_GET['action']) && $_GET['action'] == 'delete') {
        $form_id = intval($_GET['form_id']);
        // Delete form logic
        delete_form($form_id);
    }
}

Patched Code (Hypothetical):

function process_bulk_action() {
    // Add nonce check
    if (!isset($_POST['_wpnonce']) || !wp_verify_nonce($_POST['_wpnonce'], 'bulk-forms')) {
        return;
    }
    if (isset($_GET['action']) && $_GET['action'] == 'delete') {
        $form_id = intval($_GET['form_id']);
        // Delete form logic
        delete_form($form_id);
    }
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target WordPress site with Cimatti Contact Forms plugin <= 1.9.2
• Authenticated admin session (user interaction required)

Exploitation Steps:

1. Identify the target site's admin URL and form IDs (e.g., via directory enumeration or form listing).
2. Craft a CSRF payload:

   <html>
   <body>
   <h1>Click the link to win a prize!</h1>
   <a href="http://target-site.com/wp-admin/admin.php?page=cimatti-contact-forms&action=delete&form_id=1">Click here</a>
   </body>
   </html>
   

3. Host the HTML page on an attacker-controlled server.
4. Send the link to the admin via email or social engineering.
5. When the admin clicks, the form with ID 1 is deleted.

Note: No public exploit code is available. The above is a conceptual demonstration.

Blue Team

Detection:

• Monitor for unusual admin page requests to admin.php?page=cimatti-contact-forms with action=delete parameters.
• Alert on multiple form deletion requests in a short time frame.
• Check server logs for referrer headers indicating external origins.

Hunting:

• Search for requests to /wp-admin/admin.php?page=cimatti-contact-forms&action=delete without a valid _wpnonce parameter.
• Correlate with user agent and IP anomalies.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /wp-admin/admin.php?page=cimatti-contact-forms&action=delete&form_id=[0-9]+
  • Referrer headers from external domains (e.g., attacker-controlled sites)
• File IOCs:
  • Plugin file: /wp-content/plugins/cimatti-contact-forms/ (version <= 1.9.2)
• Log IOCs:
  • WordPress debug log entries showing form deletion without nonce validation

Detection Engineering

YARA Rule

rule CVE_2024_10521_CSRF {
    meta:
        description = "Detects vulnerable Cimatti Contact Forms plugin code"
        author = "Valters IT"
        date = "2025-04-17"
        reference = "CVE-2024-10521"
    strings:
        $func = "process_bulk_action" ascii wide nocase
        $nonce_missing = "wp_verify_nonce" ascii wide nocase
    condition:
        $func and not $nonce_missing
}

Sigma Rule

title: CVE-2024-10521 - Cimatti Contact Forms CSRF Detection
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects potential CSRF exploitation attempts against Cimatti Contact Forms plugin
author: Valters IT
date: 2025/04/17
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: GET
        cs-uri-query|contains: 
            - "page=cimatti-contact-forms"
            - "action=delete"
            - "form_id="
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: medium

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2024-10521 - Cimatti Contact Forms CSRF Attempt";
    flow:to_server,established;
    content:"GET";
    http_method;
    content:"/wp-admin/admin.php";
    http_uri;
    content:"page=cimatti-contact-forms";
    http_uri;
    content:"action=delete";
    http_uri;
    content:"form_id=";
    http_uri;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the Cimatti Contact Forms plugin until a patch is available.
2. Implement a Web Application Firewall (WAF) rule to block requests to admin.php?page=cimatti-contact-forms&action=delete without a valid nonce.
3. Educate administrators about phishing attacks targeting WordPress admin actions.

Long-term Fix:

• The vendor must add nonce validation to the process_bulk_action function using wp_verify_nonce().
• Monitor the plugin's official page for updates and apply patches immediately.

Workaround:

• Use a security plugin (e.g., Wordfence) that adds CSRF protection to admin actions.

Valters IT
Securing Digital Frontiers