CVE-2024-47315

Executive Summary

CVE-2024-47315 is a Cross-Site Request Forgery (CSRF) vulnerability in the GiveWP WordPress plugin, affecting versions up to and including 3.15.1. This vulnerability allows an attacker to trick an authenticated administrator into performing unintended actions, such as modifying donation forms or plugin settings, without their consent. The attack requires user interaction (clicking a crafted link) and has a CVSS score of 5.4 (Medium). As a WordPress plugin vulnerability, it specifically targets the GiveWP donation and fundraising platform ecosystem.

Supply Chain & Package Security

This vulnerability affects the GiveWP WordPress plugin, which is distributed through the official WordPress plugin repository and third-party marketplaces. Organizations using GiveWP should verify they are not running version 3.15.1 or earlier. The plugin is a critical component for many non-profits and fundraising sites, making it a high-value target for supply chain attacks.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector: Network (AV:N) – The attack can be launched remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – The attacker does not need to be authenticated.
• User Interaction: Required (UI:R) – The victim must click a malicious link or visit a crafted page.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: Low (C:L) – Limited information disclosure possible.
• Integrity Impact: Low (I:L) – Limited modification of data possible.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. The requirement for user interaction reduces the immediate risk, but the potential for phishing campaigns targeting GiveWP administrators makes this a credible threat.

Deep Dive & Mechanics

The vulnerability is a classic Cross-Site Request Forgery (CSRF) flaw in the GiveWP plugin. CSRF attacks exploit the trust a web application has in an authenticated user's browser. When an administrator is logged into their WordPress site, the browser automatically includes session cookies with every request to that site. An attacker can craft a malicious HTML page or email that, when viewed by the victim, sends a forged request to the WordPress site (e.g., changing a donation form's settings or creating a new admin user).

The specific vulnerable endpoint in GiveWP likely lacks a CSRF token or nonce validation. WordPress provides built-in nonce mechanisms for protecting against CSRF, but the GiveWP plugin may have omitted this check in certain administrative actions. The attack flow is:

1. The attacker identifies a GiveWP admin action that does not require a nonce.
2. The attacker crafts a malicious link or form that triggers this action.
3. The attacker lures an authenticated GiveWP administrator to click the link or submit the form.
4. The victim's browser sends the forged request with valid session cookies.
5. The server processes the request, believing it came from the legitimate user.

Vulnerable vs. Patched Code

Since no patch details are available, we can only describe the general fix. The vulnerable code likely looks like this:

Vulnerable Code (PHP):

// In a GiveWP admin handler
function givewp_admin_action() {
    // No nonce verification
    update_option('givewp_settings', $_POST['settings']);
    wp_redirect(admin_url('admin.php?page=give-settings'));
    exit;
}
add_action('admin_post_givewp_action', 'givewp_admin_action');

Patched Code (PHP):

function givewp_admin_action() {
    // Verify nonce
    if (!isset($_POST['_wpnonce']) || !wp_verify_nonce($_POST['_wpnonce'], 'givewp_action_nonce')) {
        wp_die('Security check failed.');
    }
    update_option('givewp_settings', $_POST['settings']);
    wp_redirect(admin_url('admin.php?page=give-settings'));
    exit;
}
add_action('admin_post_givewp_action', 'givewp_admin_action');

The patch adds a call to wp_verify_nonce() to ensure the request originated from the intended admin page.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install WordPress 6.x with GiveWP plugin version 3.15.1.
2. Create an administrator account and log in.
3. Set up a simple HTTP server to host the malicious payload.

Exploitation Steps:

1. Identify a vulnerable endpoint. For example, the GiveWP settings page might have an action like givewp_save_settings that lacks a nonce.
2. Craft a malicious HTML page that submits a form to the vulnerable endpoint:

   <html>
   <body>
   <h1>Click the button to win a prize!</h1>
   <form action="http://target-site.com/wp-admin/admin-post.php" method="POST">
       <input type="hidden" name="action" value="givewp_save_settings">
       <input type="hidden" name="givewp_settings[currency]" value="USD">
       <input type="hidden" name="givewp_settings[default_amount]" value="100">
       <input type="submit" value="Claim Prize">
   </form>
   </body>
   </html>
   

3. Host this page on an attacker-controlled server.
4. Send the link to the victim (e.g., via email or social engineering).
5. When the victim clicks the button, the form is submitted, and the GiveWP settings are modified.

Blue Team

Detection Steps:

1. Monitor for unusual POST requests to /wp-admin/admin-post.php with action parameters related to GiveWP (e.g., givewp_save_settings, givewp_create_form).
2. Check for missing _wpnonce parameters in these requests.
3. Review server logs for referrer headers that do not match the legitimate admin URL.
4. Implement Content Security Policy (CSP) headers to block external form submissions.

Hunting Query (Splunk):

index=web sourcetype=access_combined
| search uri="/wp-admin/admin-post.php" action=givewp_*
| eval has_nonce=if(match(_raw, "_wpnonce"), "yes", "no")
| where has_nonce="no"
| stats count by src_ip, uri, user_agent

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /wp-admin/admin-post.php with action=givewp_* and no _wpnonce parameter.
  • Referrer headers from external domains (e.g., attacker-controlled sites).
• File IOCs:
  • Modified GiveWP settings in the wp_options table (option name givewp_settings).
  • Unexpected GiveWP forms or donation pages created without admin interaction.
• Log IOCs:
  • Repeated failed nonce verification attempts in WordPress debug logs.
  • Unusual admin user creation or role changes.

Detection Engineering

YARA Rule

rule CVE_2024_47315_GiveWP_CSRF {
    meta:
        description = "Detects GiveWP plugin files vulnerable to CSRF (CVE-2024-47315)"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-47315"
    strings:
        $vuln_func = "admin_post_" nocase
        $no_nonce = "wp_verify_nonce" nocase
        $givewp = "givewp" nocase
    condition:
        $givewp and $vuln_func and not $no_nonce
}

Sigma Rule

title: CVE-2024-47315 GiveWP CSRF Exploitation Attempt
id: 8a3f7c2e-5d1b-4a9f-8c6e-2b3d1f0a7e4c
status: experimental
description: Detects potential CSRF exploitation against GiveWP plugin
author: Valters IT
date: 2024-10-27
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: "action=givewp_"
        cs-uri-query|contains: "admin-post.php"
    filter:
        cs-uri-query|contains: "_wpnonce"
    condition: selection and not filter
falsepositives:
    - Legitimate admin actions with missing nonce (rare)
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-47315 GiveWP CSRF Exploitation Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/wp-admin/admin-post.php";
    http_uri;
    content:"action=givewp_";
    http_client_body;
    pcre:"/action=givewp_[a-z_]+/";
    reference:cve,2024-47315;
    classtype:attempted-admin;
    sid:10000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Update GiveWP: If a patched version becomes available, update immediately. Check the WordPress plugin repository for updates.
2. Disable Unused Features: If the GiveWP plugin is not critical, temporarily deactivate it until a patch is applied.
3. Implement CSRF Protections: Ensure all admin actions in custom plugins or themes use WordPress nonces.

Long-Term Mitigations:

1. Web Application Firewall (WAF): Deploy a WAF with rules to block requests to /wp-admin/admin-post.php that lack a valid nonce.
2. Security Headers: Add X-Frame-Options: DENY and Content-Security-Policy: form-action 'self' to prevent clickjacking and external form submissions.
3. User Education: Train administrators to avoid clicking suspicious links, especially when logged into the WordPress admin panel.
4. Monitor Plugin Security: Subscribe to security advisories for all WordPress plugins in use.

Workaround (if patching is not possible):

• Add a custom function to your theme's functions.php to validate nonces for all GiveWP admin actions:

  add_action('admin_init', function() {
      if (isset($_POST['action']) && strpos($_POST['action'], 'givewp_') === 0) {
          if (!isset($_POST['_wpnonce']) || !wp_verify_nonce($_POST['_wpnonce'], $_POST['action'])) {
              wp_die('CSRF detected.');
          }
      }
  });
  

Valters IT
Securing Digital Frontiers