CVE-2024-32433

Executive Summary

CVE-2024-32433 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the BEAF – Before and After Gallery WordPress plugin by Themefic, versions up to and including 4.5.4. This vulnerability allows an attacker to trick an authenticated administrator into performing unintended actions, such as modifying plugin settings or triggering gallery operations, without their consent. The attack requires user interaction (clicking a crafted link) and has a low CVSS score of 4.3, but in a WordPress ecosystem, it can be chained with other vulnerabilities to escalate privileges or deface sites. No public exploit code or patch is currently available.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository. The supply chain risk is moderate: if the plugin is installed from an untrusted source or if the vendor fails to release a patch, site administrators may be forced to disable the plugin entirely. No known malicious packages or backdoors have been reported in the plugin’s distribution.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability requires user interaction and only allows low-integrity changes (e.g., modifying plugin settings). However, in a WordPress context, CSRF can be used to change admin email, install malicious plugins, or modify content if combined with other flaws.

Deep Dive & Mechanics

The CSRF vulnerability exists because the BEAF plugin fails to implement proper nonce validation on state-changing requests. In WordPress, CSRF protection is typically enforced via a nonce (number used once) that is checked on form submissions or AJAX actions. The BEAF plugin, in versions <= 4.5.4, does not verify this nonce for certain administrative actions, allowing an attacker to forge requests on behalf of an authenticated admin.

Attack Flow:

1. An attacker crafts a malicious HTML page or email containing a hidden form or image tag that sends a request to the vulnerable WordPress admin endpoint (e.g., /wp-admin/admin-post.php?action=beaf_update_settings&...).
2. The attacker lures an authenticated admin to visit this page (e.g., via phishing or social engineering).
3. The admin’s browser automatically sends the forged request, including their session cookies.
4. The plugin processes the request without checking the nonce, executing the attacker’s desired action (e.g., changing gallery settings, deleting images, or modifying plugin options).

Root Cause: Missing or improper nonce verification in the plugin’s admin AJAX handlers and form processing functions.

Vulnerable vs. Patched Code

Since no official patch is available, we can only analyze the vulnerable code pattern. The vulnerable code likely resembles:

// Vulnerable: No nonce check
add_action('wp_ajax_beaf_update_settings', 'beaf_update_settings_callback');
function beaf_update_settings_callback() {
    // Process $_POST data directly
    update_option('beaf_settings', $_POST['settings']);
    wp_die();
}

A patched version would include a nonce verification:

// Patched: Nonce check added
add_action('wp_ajax_beaf_update_settings', 'beaf_update_settings_callback');
function beaf_update_settings_callback() {
    // Verify nonce
    if (!isset($_POST['_wpnonce']) || !wp_verify_nonce($_POST['_wpnonce'], 'beaf_update_settings_nonce')) {
        wp_die('CSRF validation failed.');
    }
    // Process $_POST data
    update_option('beaf_settings', $_POST['settings']);
    wp_die();
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with BEAF plugin <= 4.5.4 installed and activated.
• An authenticated admin user (target).
• Attacker-controlled server to host the malicious page.

Exploitation Steps:

1. Identify the vulnerable endpoint. For example, the plugin might use admin-post.php?action=beaf_save_gallery or similar.
2. Craft a CSRF payload. Example HTML:

<html>
<body>
<form action="http://target-site.com/wp-admin/admin-post.php" method="POST" id="csrf_form">
    <input type="hidden" name="action" value="beaf_update_settings" />
    <input type="hidden" name="settings[gallery_width]" value="100" />
    <input type="hidden" name="settings[gallery_height]" value="100" />
    <input type="submit" value="Click me" />
</form>
<script>
    document.getElementById('csrf_form').submit();
</script>
</body>
</html>

3. Host this HTML on a server and send the link to the admin (e.g., via email or social media).
4. When the admin visits the page, the form auto-submits, changing the gallery settings.

Note: No public exploit code is available; this is a conceptual demonstration.

Blue Team (Detection & Defense)

Detection:

• Monitor for unexpected POST requests to /wp-admin/admin-post.php with actions related to BEAF (e.g., beaf_*).
• Look for unusual referrer headers or missing nonce parameters in admin AJAX requests.
• Use Web Application Firewall (WAF) rules to block requests to admin endpoints without a valid nonce.

Defense:

• Immediately update the plugin if a patch becomes available.
• If no patch, disable the plugin or restrict access to admin pages via IP whitelisting or .htaccess.
• Implement additional CSRF tokens at the application level (e.g., using WordPress nonces).
• Educate administrators about phishing attacks and the importance of not clicking suspicious links while logged in.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /wp-admin/admin-post.php with action parameter starting with beaf_ and no _wpnonce parameter.
  • Referrer header pointing to an external domain (e.g., attacker-controlled site).
• File IOCs:
  • Modified plugin settings in the wp_options table (option name beaf_settings or similar).
  • Unexpected changes to gallery configurations or image metadata.
• Log IOCs:
  • WordPress debug log entries showing missing nonce warnings (if WP_DEBUG enabled).
  • Apache/Nginx access logs with unusual POST requests to admin-post.php from external referrers.

Detection Engineering

YARA Rule

rule CVE_2024_32433_CSRF_BEAF {
    meta:
        description = "Detects CSRF exploitation attempts against BEAF plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-32433"
    strings:
        $action = /action=beaf_[a-z_]+/ nocase
        $admin_post = "admin-post.php"
        $missing_nonce = /(?!.*_wpnonce).*action=beaf_/ nocase
    condition:
        $admin_post and $action and #missing_nonce > 0
}

Sigma Rule

title: CVE-2024-32433 CSRF Exploitation Against BEAF Plugin
id: 8a3f7c2e-1b4d-4e5f-9a0b-1c2d3e4f5a6b
status: experimental
description: Detects HTTP POST requests to WordPress admin-post.php with BEAF actions lacking nonce
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: 'admin-post.php'
        cs-uri-query|contains: 'action=beaf_'
    filter:
        cs-uri-query|contains: '_wpnonce'
    condition: selection and not filter
falsepositives:
    - Legitimate admin actions if nonce is missing due to plugin bug
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-32433 - BEAF Plugin CSRF Exploitation";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"admin-post.php"; http_uri;
    content:"action=beaf_"; http_uri;
    pcre:"/action=beaf_[a-z_]+/i";
    pcre:"/^(?!.*_wpnonce).*$/i";
    sid:1000001;
    rev:1;
    reference:cve,2024-32433;
    classtype:attempted-admin;
    priority:2;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if no patch is available and the plugin is not critical for operations.
2. Restrict admin access to trusted IPs using .htaccess or a firewall.
3. Monitor logs for suspicious POST requests to admin-post.php with BEAF actions.

Long-Term Fix:

• The vendor (Themefic) must release a patched version (>= 4.5.5) that adds proper nonce verification to all admin AJAX handlers and form processing functions.
• Until then, consider using a Web Application Firewall (WAF) with custom rules to block CSRF attempts.
• Implement Content Security Policy (CSP) headers to prevent form submission from external origins.

Workaround:

• Add a custom function to the theme’s functions.php to validate nonces for BEAF actions:

add_action('init', function() {
    if (isset($_POST['action']) && strpos($_POST['action'], 'beaf_') === 0) {
        if (!isset($_POST['_wpnonce']) || !wp_verify_nonce($_POST['_wpnonce'], 'beaf_nonce')) {
            wp_die('CSRF detected.');
        }
    }
});

Valters IT
DevSecOps & Cyber Threat Intelligence