CVE-2024-31433

Executive Summary

CVE-2024-31433 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the WordPress plugin The Events Calendar by StellarWP, up to and including version 6.3.0. This vulnerability allows an attacker to trick an authenticated administrator into performing unintended actions, such as modifying event settings or deleting events, without their consent. The attack requires user interaction (clicking a crafted link) and does not directly expose sensitive data, but it can lead to unauthorized configuration changes within the WordPress ecosystem. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the lack of a confirmed patch makes it a persistent risk for unmaintained sites.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository. The supply chain risk is moderate: if the plugin is not updated by the vendor, site administrators must manually apply mitigations or remove the plugin. No known malicious packages have been observed exploiting this CVE.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network (AV:N) – The attacker can trigger the CSRF remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – The attacker does not need authentication.
• User Interaction: Required (UI:R) – The victim must click a malicious link or visit a crafted page.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: None (C:N) – No data exposure.
• Integrity Impact: Low (I:L) – Unauthorized modifications possible.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. The CSRF vector requires social engineering, but if exploited, an attacker can alter event data, potentially causing reputational damage or disrupting scheduled events.

Deep Dive & Mechanics

The vulnerability stems from the absence of CSRF nonce validation in certain administrative actions within The Events Calendar plugin. In WordPress, CSRF protection is typically implemented using nonces (number used once) embedded in forms and URLs. The plugin fails to verify these nonces for specific AJAX or POST requests, allowing an attacker to forge requests on behalf of an authenticated administrator.

Attack Flow:

1. The attacker crafts a malicious HTML page or email containing a hidden form or image tag that submits a request to the victim’s WordPress site (e.g., wp-admin/admin-ajax.php?action=delete_event&event_id=123).
2. The victim, who is logged in as an administrator, visits the attacker’s page.
3. The victim’s browser automatically sends the forged request, including their session cookies.
4. The WordPress server processes the request without checking for a valid nonce, executing the attacker’s action (e.g., deleting an event).

The vulnerability affects all actions that do not implement check_admin_referer() or check_ajax_referer() calls.

Vulnerable vs. Patched Code

Vulnerable Code (<= 6.3.0):

// In a vulnerable AJAX handler
add_action('wp_ajax_delete_event', 'delete_event_callback');
function delete_event_callback() {
    // No nonce check
    $event_id = intval($_POST['event_id']);
    wp_delete_post($event_id, true);
    wp_die();
}

Patched Code (Hypothetical):

// In a patched AJAX handler
add_action('wp_ajax_delete_event', 'delete_event_callback');
function delete_event_callback() {
    // Nonce verification added
    if (!check_ajax_referer('delete_event_nonce', 'nonce', false)) {
        wp_die('CSRF validation failed.');
    }
    $event_id = intval($_POST['event_id']);
    wp_delete_post($event_id, true);
    wp_die();
}

The patch adds a call to check_ajax_referer() with a unique nonce value, ensuring the request originated from the legitimate admin interface.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A WordPress site with The Events Calendar <= 6.3.0 installed and an admin user logged in.
• The attacker must host a malicious HTML page.

Exploit Payload (CSRF via Image Tag):

<html>
<body>
<h1>Click me!</h1>
<img src="http://target-site.com/wp-admin/admin-ajax.php?action=delete_event&event_id=1" style="display:none;">
</body>
</html>

Step-by-Step:

1. Host the above HTML on an attacker-controlled server.
2. Send the link to the victim (e.g., via phishing email).
3. When the victim visits the page, the browser sends a GET request to delete event ID 1.
4. The event is deleted without the victim’s knowledge.

Note: This is a simplified example. Real-world exploitation may require POST requests or additional parameters.

Blue Team (Detection & Defense)

Detection:

• Monitor for unexpected admin-ajax.php requests with actions like delete_event, update_event, or save_settings without a corresponding nonce parameter.
• Look for referrer headers that do not match the WordPress admin domain.

Defense:

• Apply the vendor patch immediately if available.
• Implement a Web Application Firewall (WAF) rule to block requests to admin-ajax.php that lack a valid nonce.
• Educate administrators about phishing risks and the importance of logging out after sessions.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Suspicious requests to /wp-admin/admin-ajax.php with actions related to The Events Calendar (e.g., delete_event, update_event).
  • Referrer headers pointing to external domains.
• File IOCs:
  • Modified or deleted event posts in the WordPress database.
  • Unexpected entries in the wp_posts table with post type tribe_events.
• Log IOCs:
  • Repeated admin-ajax.php calls from the same IP without a nonce parameter.
  • User agent strings indicating automated tools.

Detection Engineering

YARA Rule

rule CVE_2024_31433_CSRF_Events_Calendar {
    meta:
        description = "Detects CSRF exploitation attempts against The Events Calendar plugin"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-31433"
    strings:
        $ajax_action = "admin-ajax.php"
        $event_action = "action=delete_event" nocase
        $event_action2 = "action=update_event" nocase
        $event_action3 = "action=save_settings" nocase
    condition:
        $ajax_action and any of ($event_action*)
}

Sigma Rule

title: CVE-2024-31433 CSRF Exploitation Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests targeting The Events Calendar admin-ajax.php without a valid nonce
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        c-uri|contains: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 
            - 'action=delete_event'
            - 'action=update_event'
            - 'action=save_settings'
    condition: selection
falsepositives:
    - Legitimate admin actions with valid nonces (not easily distinguishable without deep packet inspection)
level: medium

Suricata Rule

alert http any any -> $HOME_NET any (msg:"CVE-2024-31433 CSRF Attempt - The Events Calendar"; flow:to_server,established; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=delete_event"; http_uri; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable The Events Calendar plugin if no patch is available and the site is not actively using it.
2. Vendor Patch: Monitor the StellarWP plugin repository for an update. Apply version 6.3.1 or later as soon as it is released.
3. Workaround: Implement a custom nonce check by adding the following code to the theme's functions.php:

   add_action('wp_ajax_delete_event', 'custom_csrf_check', 1);
   function custom_csrf_check() {
       if (!check_ajax_referer('delete_event_nonce', 'nonce', false)) {
           wp_die('CSRF validation failed.');
       }
   }
   

4. WAF Rule: Block requests to admin-ajax.php that do not include a valid nonce parameter.
5. User Training: Educate administrators on recognizing phishing attempts and the importance of using browser extensions that block CSRF attacks.

Valters IT
Securing Digital Frontiers