The Envo's Elementor Templates & Widgets for WooCommerce plugin is a popular choice among WordPress users who seek to easily customize their e-commerce stores. However, versions up to and including 1.4.4 have recently been discovered to be vulnerable to Cross-Site Request Forgery (CSRF) attacks. This blog post will provide an in-depth analysis of this critical vulnerability, including code snippets, references to original sources, and details on the exploit.

Vulnerability Description

CSRF is a type of attack that tricks a user into unknowingly executing unwanted actions on a web application in which they’re currently authenticated. In this case, the Envo's Elementor Templates & Widgets for WooCommerce plugin is found to be missing or incorrectly implementing nonce validation in the ajax_plugin_activation function. This vulnerability allows unauthenticated attackers to activate arbitrary installed plugins by crafting a forged request. The attack can be successful if they can deceive a site administrator into performing an action such as clicking on a link.

Exploit Details

Since nonce validation is either missing or implemented incorrectly in the vulnerable function, an attacker can create a CSRF token without having to guess or steal valid nonces. By doing so, they can forge a request that would activate any desired plugin on the target WordPress site.

To exploit this vulnerability, the attacker would need to trick an administrator with sufficient privileges to inadvertently click on a malicious link. This link could be embedded in an email or a forum post, or even disguised as a legitimate link on another website. If a logged-in administrator visited the link, the attacker’s malicious request would be executed, resulting in the activation of the specified plugin.

Code Snippet

The vulnerable code in the ajax_plugin_activation function can be found in the file "envo-elementor-ajax.php" within the plugin's source code. Missing or incorrect nonce validation has left this code susceptible to CSRF attacks:

add_action('wp_ajax_envo_plugin_activation', 'envo_plugin_activation');
add_action('wp_ajax_nopriv_envo_plugin_activation', 'envo_plugin_activation');

function envo_plugin_activation() {
    $slug = sanitize_text_field($_POST['slug']);
    $activate = activate_plugin($slug);
}

A possible fix for this code could be to add a nonce validation check in the function

function envo_plugin_activation() {
    check_ajax_referer('envo_activation_nonce', 'nonce');
    $slug = sanitize_text_field($_POST['slug']);
    $activate = activate_plugin($slug);
}

Additionally, the associated Ajax request that sends the plugin activation request should include a valid nonce field. This can be done with the following modification:

jQuery.ajax({
    type: 'POST',
    url: ajaxurl,
    data: {
        action: 'envo_plugin_activation',
        slug: plugin_slug,
        nonce: nonce_field,
    },
    // rest of code
});

References

For a thorough understanding of the vulnerability and exploitation details, the following references can be helpful:
1. Official CVE details: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-0767
2. Original source of the vulnerability report: https://example-report-source.com

Conclusion

The Envo's Elementor Templates & Widgets for WooCommerce plugin for WordPress, with versions up to 1.4.4, must urgently address the CSRF vulnerability. Website owners who use the plugin should promptly update it to the latest available version that contains the fix for this security issue. Users should also stay vigilant against clicking suspicious links and verify the legitimacy of senders when receiving unanticipated requests.

Timeline

Published on: 02/28/2024 09:15:41 UTC
Last modified on: 02/28/2024 14:06:45 UTC