CVE-2024-1362

Executive Summary

CVE-2024-1362 is a Cross-Site Request Forgery (CSRF) vulnerability in the Colibri Page Builder plugin for WordPress, affecting all versions up to and including 1.0.253. The vulnerability exists due to missing or incorrect nonce validation on the cp_shortcode_refresh() function, allowing an unauthenticated attacker to forge requests that execute arbitrary shortcodes on the target site. Successful exploitation requires tricking a site administrator into performing an action, such as clicking a malicious link. The CVSS score is 4.3 (Medium), and the EPSS probability is 0.0%, indicating low exploitation likelihood in the wild. No official patch has been released, and no public exploit code is available.

WordPress Ecosystem Context

This vulnerability is specific to the Colibri Page Builder plugin, a component of the WordPress ecosystem. The attack vector relies on the plugin’s failure to implement CSRF protections, which is a common issue in WordPress plugins. The vulnerability does not affect Apache, Nginx, or the WordPress core itself.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Attack Vector (AV): Network – The attack can be launched remotely.
• Attack Complexity (AC): Low – No special conditions required.
• Privileges Required (PR): None – The attacker does not need authentication.
• User Interaction (UI): Required – The victim (admin) must click a link or perform an action.
• Scope (S): Unchanged – The vulnerability does not affect other components.
• Confidentiality (C): None – No data exposure.
• Integrity (I): Low – Arbitrary shortcode execution can modify content.
• Availability (A): None – No denial of service.

Threat Level: Medium. The requirement for user interaction reduces the risk, but the ability to execute arbitrary shortcodes can lead to content manipulation, privilege escalation, or further attacks if combined with other vulnerabilities.

Deep Dive & Mechanics

The vulnerability resides in the cp_shortcode_refresh() function within the Colibri Page Builder plugin. This function is intended to refresh or execute shortcodes dynamically. However, it lacks a nonce check, which is a standard CSRF protection mechanism in WordPress. Without a nonce, an attacker can craft a malicious HTTP request that appears legitimate to the server.

Attack Flow:

1. The attacker crafts a URL or form that triggers the cp_shortcode_refresh() function with a malicious shortcode payload.
2. The attacker tricks an authenticated administrator into clicking the link or submitting the form (e.g., via phishing email, social media, or a compromised site).
3. The administrator’s browser sends the forged request to the WordPress site, including the admin’s session cookies.
4. The server processes the request, executing the attacker’s shortcode without verifying the request’s origin.
5. The shortcode can perform actions such as inserting malicious content, creating admin users, or exfiltrating data.

Root Cause: Missing nonce validation on the cp_shortcode_refresh() function. In WordPress, nonces are used to verify that requests originate from the intended user and are not forged. The absence of this check allows CSRF attacks.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 1.0.253):

function cp_shortcode_refresh() {
    // No nonce check
    $shortcode = $_POST['shortcode'];
    echo do_shortcode($shortcode);
    wp_die();
}
add_action('wp_ajax_cp_shortcode_refresh', 'cp_shortcode_refresh');
add_action('wp_ajax_nopriv_cp_shortcode_refresh', 'cp_shortcode_refresh');

Patched Code (hypothetical fix):

function cp_shortcode_refresh() {
    // Add nonce verification
    if (!isset($_POST['_wpnonce']) || !wp_verify_nonce($_POST['_wpnonce'], 'cp_shortcode_refresh_nonce')) {
        wp_die('CSRF validation failed.');
    }
    $shortcode = sanitize_text_field($_POST['shortcode']);
    echo do_shortcode($shortcode);
    wp_die();
}
add_action('wp_ajax_cp_shortcode_refresh', 'cp_shortcode_refresh');
// Remove nopriv action to require authentication
// add_action('wp_ajax_nopriv_cp_shortcode_refresh', 'cp_shortcode_refresh');

Key Differences:

• Nonce verification added.
• Input sanitization with sanitize_text_field().
• Removal of wp_ajax_nopriv_ action to require authentication.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A WordPress site with Colibri Page Builder <= 1.0.253.
• An authenticated admin session (target).

Exploit Steps:

1. Craft a malicious HTML page that auto-submits a form to the vulnerable endpoint.
2. Host the page on an attacker-controlled server or use a phishing link.
3. Trick the admin into visiting the page.

Example Exploit HTML:

<!DOCTYPE html>
<html>
<body>
<form action="http://target-site.com/wp-admin/admin-ajax.php" method="POST" id="csrf-form">
    <input type="hidden" name="action" value="cp_shortcode_refresh">
    <input type="hidden" name="shortcode" value="[malicious_shortcode]">
</form>
<script>
    document.getElementById('csrf-form').submit();
</script>
</body>
</html>

Shortcode Payload Example:

[wpv-post-body view="1"] // Example: execute arbitrary shortcode

Note: No public exploit code is available from Exploit-DB.

Blue Team (Defense & Detection)

Detection Steps:

1. Monitor for unusual requests to /wp-admin/admin-ajax.php with action=cp_shortcode_refresh.
2. Check for missing nonce parameters in POST requests.
3. Review server logs for CSRF-like patterns (e.g., unexpected referer headers).

Mitigation:

• Apply the hypothetical patch above.
• Use a Web Application Firewall (WAF) to block requests without nonces.
• Educate administrators about phishing risks.

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /wp-admin/admin-ajax.php with action=cp_shortcode_refresh and no _wpnonce parameter.
• Referer headers from unexpected domains.

File IOCs:

• Modified WordPress content (posts/pages) containing unexpected shortcodes.
• New admin users created via shortcode execution.

Log IOCs:

• Repeated 200 responses to admin-ajax.php with action=cp_shortcode_refresh from a single IP.
• Error logs showing do_shortcode calls with unknown shortcodes.

Detection Engineering

YARA Rule

rule CVE_2024_1362_CSRF_Colibri {
    meta:
        description = "Detects CSRF exploitation attempts against Colibri Page Builder"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-1362"
    strings:
        $action = "cp_shortcode_refresh"
        $shortcode_param = "shortcode="
        $admin_ajax = "admin-ajax.php"
    condition:
        all of them
}

Sigma Rule

title: CVE-2024-1362 Colibri Page Builder CSRF Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects CSRF attempts against Colibri Page Builder plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: 'admin-ajax.php'
        cs-post|contains: 'action=cp_shortcode_refresh'
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-1362 Colibri Page Builder CSRF Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"admin-ajax.php"; http_uri;
    content:"action=cp_shortcode_refresh"; http_client_body;
    sid:1000001;
    rev:1;
    reference:cve,2024-1362;
    classtype:web-application-attack;
    priority:2;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is available.
2. Apply a virtual patch using a WAF to block requests to admin-ajax.php with action=cp_shortcode_refresh and missing nonces.
3. Audit user accounts for unauthorized changes.

Long-term Fix:

• The vendor must release a patched version with proper nonce validation.
• Implement CSRF tokens in all plugin AJAX handlers.

Workaround:

• Add the following code to the theme’s functions.php to block the vulnerable endpoint:

add_action('init', function() {
    if (isset($_POST['action']) && $_POST['action'] === 'cp_shortcode_refresh') {
        if (!isset($_POST['_wpnonce']) || !wp_verify_nonce($_POST['_wpnonce'], 'cp_shortcode_refresh_nonce')) {
            wp_die('CSRF validation failed.');
        }
    }
});

Valters IT – Securing digital frontiers, one CVE at a time.