CVE-2024-22304

Executive Summary

CVE-2024-22304 is a Cross-Site Request Forgery (CSRF) vulnerability in the FreshMail For WordPress plugin, developed by Borbis Media. This flaw affects all versions from n/a through 2.3.2. The vulnerability allows an attacker to trick an authenticated administrator into performing unintended actions, such as modifying plugin settings or triggering email campaigns, without their consent. Given the WordPress ecosystem context, this issue is particularly dangerous as it can be chained with other vulnerabilities to achieve full site compromise. No public exploit code or proof-of-concept is currently available, and the vendor has not released a patch.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed through the official WordPress plugin repository. Users who have installed FreshMail For WordPress from the WordPress dashboard or via direct download are at risk. The plugin is not available on NPM, PyPI, Go, or Ruby registries. The lack of a patch from the vendor means that users must rely on alternative mitigation strategies, such as disabling the plugin or implementing web application firewall (WAF) rules.

CVSS Breakdown & Threat Level

• CVSS Score: 5.4 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

The threat level is considered medium due to the requirement for user interaction (a logged-in admin must click a malicious link). However, the impact could be escalated if combined with other vulnerabilities, such as stored XSS.

Deep Dive & Mechanics

The FreshMail For WordPress plugin integrates with the FreshMail email marketing service. The CSRF vulnerability exists because the plugin does not implement proper nonce validation or other CSRF tokens in its administrative actions. An attacker can craft a malicious HTML page or email that, when viewed by an authenticated WordPress admin, triggers a forged request to the plugin's settings page. This could allow the attacker to:

• Change API keys or connection settings.
• Initiate unauthorized email campaigns.
• Modify subscriber lists.
• Disable the plugin.

The attack requires the victim to be logged into WordPress and to interact with the malicious link (e.g., by clicking a button or loading an image). Since the request is made from the victim's browser, it inherits their session and privileges.

Vulnerable vs. Patched Code

Since no patch is available, we can only analyze the vulnerable code pattern. The vulnerability likely resides in the plugin's admin-facing functions that handle form submissions without CSRF protection.

Vulnerable Code (Conceptual):

// In freshmail-admin.php
function freshmail_save_settings() {
    if ( isset( $_POST['freshmail_api_key'] ) ) {
        update_option( 'freshmail_api_key', sanitize_text_field( $_POST['freshmail_api_key'] ) );
    }
    // No nonce check or CSRF token validation
}
add_action( 'admin_post_freshmail_save_settings', 'freshmail_save_settings' );

Patched Code (Conceptual):

function freshmail_save_settings() {
    // Verify nonce
    if ( ! isset( $_POST['freshmail_nonce'] ) || ! wp_verify_nonce( $_POST['freshmail_nonce'], 'freshmail_save_settings' ) ) {
        wp_die( 'CSRF validation failed.' );
    }
    if ( isset( $_POST['freshmail_api_key'] ) ) {
        update_option( 'freshmail_api_key', sanitize_text_field( $_POST['freshmail_api_key'] ) );
    }
}
add_action( 'admin_post_freshmail_save_settings', 'freshmail_save_settings' );

The patched version adds a nonce check using WordPress's built-in wp_verify_nonce() function, which prevents CSRF attacks.

Exploitation & Lab Setup

Red Team

Since no public exploit code exists, a red team operator would need to craft a custom CSRF exploit. The following is a conceptual HTML page that could be used to trigger the vulnerability:

<html>
<body>
<h1>Click this link to win a prize!</h1>
<form action="http://target-site.com/wp-admin/admin-post.php" method="POST">
    <input type="hidden" name="action" value="freshmail_save_settings">
    <input type="hidden" name="freshmail_api_key" value="attacker_controlled_key">
    <input type="submit" value="Claim Prize">
</form>
</body>
</html>

Lab Setup:

1. Install a local WordPress instance (e.g., using Docker or XAMPP).
2. Install FreshMail For WordPress version 2.3.2.
3. Log in as an administrator.
4. Host the malicious HTML page on a separate server or local file.
5. Trick the admin into visiting the page and clicking the submit button.
6. Observe that the API key is changed without the admin's knowledge.

Blue Team

Detection:

• Monitor for unexpected changes to WordPress options, especially freshmail_api_key.
• Look for HTTP requests to /wp-admin/admin-post.php with action=freshmail_save_settings originating from unusual referrers.
• Use a WAF to block requests that lack a valid nonce parameter.

Hunting:

• Search web server logs for POST requests to admin-post.php with action parameters related to FreshMail.
• Correlate with user sessions to identify potential CSRF attacks.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /wp-admin/admin-post.php with action=freshmail_save_settings and no freshmail_nonce parameter.
  • Referrer headers from external domains (e.g., attacker-controlled sites).
• Host:
  • Unexpected changes to the freshmail_api_key option in the WordPress database.
  • Presence of malicious HTML files on the server (if the attacker uploaded them).
• Logs:
  • WordPress debug logs showing failed nonce checks (if patched).
  • Web server access logs with unusual POST requests to admin endpoints.

Detection Engineering

YARA Rule

rule CVE_2024_22304_CSRF_FreshMail {
    meta:
        description = "Detects CSRF exploit attempts against FreshMail For WordPress plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-22304"
    strings:
        $action = "freshmail_save_settings"
        $api_key = "freshmail_api_key"
    condition:
        all of them
}

Sigma Rule

title: CSRF Exploit Against FreshMail For WordPress
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects POST requests to WordPress admin-post.php with FreshMail actions
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: "action=freshmail_save_settings"
    condition: selection
falsepositives:
    - Legitimate admin actions (if nonce is present)
level: medium

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2024-22304 - FreshMail CSRF Exploit Attempt";
    flow:to_server,established;
    http.method; content:"POST";
    http.uri; content:"/wp-admin/admin-post.php";
    http.client_body; content:"action=freshmail_save_settings";
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Since no official patch is available, the following mitigations are recommended:

1. Disable the Plugin: Immediately deactivate and uninstall FreshMail For WordPress until a patch is released.
2. Web Application Firewall (WAF): Implement custom WAF rules to block POST requests to admin-post.php that contain action=freshmail_save_settings without a valid nonce.
3. CSRF Protection: If you must continue using the plugin, consider adding a reverse proxy that injects CSRF tokens into all admin requests.
4. User Education: Train administrators to avoid clicking suspicious links while logged into WordPress.
5. Monitor: Continuously monitor for unauthorized changes to plugin settings.

Valters IT
Securing Digital Frontiers