The Categorify plugin is a popular WordPress plugin that helps users categorize their posts and organize their website more efficiently. However, a Cross-Site Request Forgery (CSRF) vulnerability has been discovered in all versions up to, and including, 1..7.4 of this plugin. This vulnerability can potentially compromise your website by allowing unauthenticated attackers to perform malicious actions on a site administrator's behalf, such as updating the folder position of categories and updating the metadata of other taxonomies via a forged request. This article will provide a detailed analysis of this vulnerability, its impact, and the steps needed to secure your website against it.

Technical Details

The CSRF vulnerability exists due to the incorrect or missing nonce validation in the categorifyAjaxUpdateFolderPosition function within the Categorify plugin. The relevant code snippet is shown below:

function categorify_ajax_update_folder_position() {
    global $wpdb;
    $term_id = intval($_POST['term_id']);
    $position = intval($_POST['position']);
    ...
}
add_action('wp_ajax_update-folder-position', 'categorify_ajax_update_folder_position');

The function is missing the vital check_ajax_referer call that would validate the nonce and ensure the request is coming from a trusted source. The absence of this step makes it possible for attackers to create forged requests that can update the folder positions of categories and edit metadata on other taxonomies without being detected.

Since the attacker only needs to trick a site administrator into performing an action, such as clicking a link, they can easily manipulate the target website. This can cause various types of issues, including data tampering, unauthorized access to sensitive information, and site defacement.

Exploit Details

To exploit this vulnerability and perform a CSRF attack, an unauthenticated attacker would need to craft a malicious URL or HTML page containing a forged request to the vulnerable WordPress site. By tricking a site administrator into clicking on the link or visiting the malicious page, the attacker's forged request would be executed with the privileges of the site administrator. This enables the attacker to make changes to the folder positions of categories and update metadata of other taxonomies.

Here's an example of an HTML page crafted by an attacker

<html>
  <body>
    <form action="http://your-vulnerable-wordpress-site.com/wp-admin/admin-ajax.php?action=update-folder-position"; method="POST">
      <input type="hidden" name="term_id" value="1" />
      <input type="hidden" name="position" value="2" />
      <input type="submit" value="Click me" />
    </form>
  </body>
</html>

If the site administrator is logged in and clicks on the "Click me" button, the forged request will update the folder position of the category with a term_id of 1.

Mitigation and Recommendations

To secure your website and protect against this vulnerability, users of the Categorify plugin should update to the latest version as soon as possible. If the plugin developer has not yet released a security update, you may need to consider disabling or uninstalling the plugin until a patch is available.

Additionally, it's essential to educate website administrators about the importance of being cautious when clicking on links and visiting websites, especially from unknown sources. Using a strong password policy, enabling two-factor authentication, and employing a reliable web application firewall (WAF) can also help minimize the risk of exploitation.

Conclusion

The CVE-2024-1912 vulnerability in the Categorify plugin for WordPress poses a significant threat to website security by allowing unauthenticated attackers to update site data via CSRF attacks. Staying up-to-date with security updates, following best practices, and being vigilant online can aid in minimizing the risk of exploitation.

Timeline

Published on: 02/27/2024 11:15:09 UTC
Last modified on: 02/27/2024 14:19:41 UTC