CVE-2024-1592

Executive Summary

CVE-2024-1592 is a Cross-Site Request Forgery (CSRF) vulnerability in the Complianz – GDPR/CCPA Cookie Consent plugin for WordPress. The flaw exists in all versions up to and including 6.5.6, due to missing or incorrect nonce validation on the process_delete function in class-DNSMPD.php. This allows an unauthenticated attacker to forge requests that delete GDPR data requests, provided they can trick a site administrator into clicking a malicious link. The vulnerability has a CVSS score of 4.3 (Medium) and an EPSS score of 0.0%, indicating low exploitation likelihood at this time. No public proof-of-concept or exploit code is available.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users are advised to update to the latest patched version once available. No supply chain compromise has been identified.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – the attacker must trick an administrator into clicking a link.
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L) – deletion of GDPR data requests.
• Availability Impact: None (A:N)

Threat Level: Medium. Exploitation requires user interaction but can lead to unauthorized deletion of sensitive GDPR-related data requests.

Deep Dive & Mechanics

The vulnerability resides in the process_delete function within the class-DNSMPD.php file of the Complianz plugin. This function handles the deletion of Data Subject Access Requests (DSARs) or other GDPR data requests. The function fails to validate a nonce (number used once) before processing the deletion, making it susceptible to CSRF attacks.

Attack Flow:

1. An attacker crafts a malicious link or form that triggers the process_delete function with a specific request ID.
2. The attacker sends this link to a logged-in site administrator (e.g., via email or social engineering).
3. If the administrator clicks the link while authenticated, the forged request is executed, deleting the targeted GDPR data request without the administrator's knowledge.

The lack of nonce validation means the plugin does not verify that the request originated from the intended user, allowing cross-origin attacks.

Vulnerable vs. Patched Code

Vulnerable Code (<= 6.5.6):

// class-DNSMPD.php
public function process_delete() {
    // No nonce check
    $request_id = isset($_GET['request_id']) ? intval($_GET['request_id']) : 0;
    if ($request_id) {
        // Delete the request
        DNSMPD::delete_request($request_id);
    }
}

Patched Code (Hypothetical):

// class-DNSMPD.php
public function process_delete() {
    // Added nonce verification
    if (!isset($_GET['_wpnonce']) || !wp_verify_nonce($_GET['_wpnonce'], 'delete_request_' . $_GET['request_id'])) {
        wp_die('Security check failed.');
    }
    $request_id = isset($_GET['request_id']) ? intval($_GET['request_id']) : 0;
    if ($request_id) {
        DNSMPD::delete_request($request_id);
    }
}

The patched version adds a call to wp_verify_nonce() to ensure the request is legitimate.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A WordPress site with Complianz plugin version <= 6.5.6.
• An authenticated administrator session.

Exploit Steps:

1. Identify a valid GDPR request ID (e.g., by observing the admin interface).
2. Craft a malicious HTML page or email link:

   <a href="http://target-site.com/wp-admin/admin-post.php?action=complianz_delete_request&request_id=123">Click here</a>
   

3. Send the link to an administrator. When clicked, the request is deleted.

Note: No public exploit code is available. This is a conceptual demonstration.

Blue Team (Defense & Detection)

Detection:

• Monitor for unusual patterns of GDPR request deletions.
• Check server logs for admin-post.php requests with action=complianz_delete_request and no referrer header.

Prevention:

• Update the plugin to the latest version once a patch is released.
• Implement Web Application Firewall (WAF) rules to block requests missing nonce parameters.
• Educate administrators about phishing attacks targeting CSRF.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /wp-admin/admin-post.php?action=complianz_delete_request&request_id=<number> without a valid _wpnonce parameter.
  • Referrer header missing or from an external domain.
• Host:
  • Unexpected deletion of GDPR data requests in the WordPress database.
  • Log entries showing process_delete calls without preceding nonce validation.

Detection Engineering

YARA Rule

rule CVE_2024_1592_Complianz_CSRF {
    meta:
        description = "Detects vulnerable Complianz GDPR plugin versions with missing nonce in process_delete"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-1592"
    strings:
        $vuln_func = "function process_delete()" ascii wide
        $no_nonce = "process_delete" ascii wide
    condition:
        $vuln_func and not $no_nonce
}

Sigma Rule

title: CVE-2024-1592 - Complianz GDPR CSRF Deletion Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CSRF in Complianz GDPR plugin by monitoring for deletion requests without nonce.
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: "GET"
        c-uri|contains: "admin-post.php?action=complianz_delete_request"
        cs-referer|contains: ""  # Missing or empty referer
    condition: selection
falsepositives:
    - Legitimate admin actions with proper nonce (not covered by this rule)
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-1592 - Complianz GDPR CSRF Deletion Attempt"; flow:to_server,established; content:"GET"; http_method; content:"admin-post.php"; http_uri; content:"action=complianz_delete_request"; http_uri; pcre:"/request_id=\d+/"; reference:cve,2024-1592; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update the plugin: Check for a patched version (>= 6.5.7) and update immediately.
2. Temporary workaround: Disable the Complianz plugin if not critical, or restrict access to the admin-post.php endpoint via .htaccess or WAF rules.
3. User education: Warn administrators about phishing attempts targeting CSRF vulnerabilities.

Long-term Fix:

• The vendor must add nonce validation to the process_delete function as shown in the patched code example.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.