CVE-2022-34654: Exploring Cross-Site Request Forgery (CSRF) Vulnerability in Virgial Berveling's Manage Notification E-mails Plugin <= 1.8.2 on WordPress

We've come across a new vulnerability in one of the popular plugins used in WordPress, Virgial Berveling's Manage Notification E-mails plugin. In this post, we'll dive into the details of this vulnerability, tagged as CVE-2022-34654, and discuss its implications, along with providing code snippets and references to help you better understand the issue and take necessary actions to secure your WordPress installation.

Overview of CVE-2022-34654

CVE-2022-34654 is a Cross-Site Request Forgery (CSRF) vulnerability that affects the Manage Notification E-mails plugin (version <= 1.8.2) for WordPress. This plugin allows you to manage the notification emails sent by WordPress to its users, making it easier for administrators to customize email templates and logs.

However, the vulnerability allows an attacker to trick an authenticated administrator into performing unintended actions on the WordPress website. By exploiting this vulnerability, an attacker can potentially take control of the affected WordPress site and gain access to sensitive information or execute malicious actions.

Exploit Details

The vulnerability exists in the plugin's settings pages, which do not have proper validation and checks in place. This allows an attacker to perform actions such as modifying settings, adding new email templates, or deleting existing ones on behalf of an authenticated administrator without their knowledge.

As an example, let's consider the following code snippet

<form method="post" action="options.php">
  <?php settings_fields('mne_group'); ?>
  <input type="hidden" name="mne[type]" value="disable">
  <button type="submit">Disable E-mails</button>
</form>

In this example, we can see that the form is submitted to "options.php" and the hidden input "mne[type]" has a value of "disable". When the button is clicked, the settings will be changed, and the e-mails are disabled. However, there is no CSRF token or nonce included in the form, making it vulnerable to CSRF attacks.

An attacker can craft a malicious link or embed it into a phishing email, which, when clicked by an authenticated administrator, can perform unauthorized actions such as disabling email notifications.

Here's an example of a malicious URL crafted by an attacker

https://example.com/wp-admin/options-general.php?page=manage_notification_emails&mne[type]=disable&_wpnonce=malicious-csrf-token

How to Fix

To prevent this vulnerability from being exploited, it is essential to upgrade the Manage Notification E-mails plugin to the latest version (1.8.3 or higher). The plugin author has released a patch that fixes the CSRF vulnerability by adding proper nonce checks to the settings pages.

Additionally, always ensure that your WordPress installation, plugins, and themes are up-to-date and well-maintained, and implement security best practices to avoid falling victim to this type of vulnerability in the future.

Original References

1. Virgial Berveling's Manage Notification E-mails plugin: https://wordpress.org/plugins/manage-notification-emails/
2. WordPress Plugin Vulnerability Database (CVE-2022-34654): https://wpvulndb.com/vulnerabilities/10984
3. Official CVE report: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34654

Conclusion

Awareness of vulnerabilities like CVE-2022-34654 and swift upgrading of affected plugins plays a significant role in keeping your WordPress site secured. Stay informed about possible security vulnerabilities by keeping an eye on various security blogs and resources and subscribing to security mailing lists. By staying proactive, you'll minimize the risk of your site being exploited by attackers.

Timeline

Published on: 11/28/2022 20:15:00 UTC
Last modified on: 12/01/2022 22:57:00 UTC