CVE-2024-37230: Book Landing Page CSRF Vulnerability

CVE-2024-37230 Overview

CVE-2024-37230 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Rara Theme Book Landing Page, a WordPress theme. The flaw exists in all versions up to and including 1.2.3. Tracked under CWE-352, the vulnerability allows attackers to trick authenticated users into submitting forged state-changing requests to a vulnerable WordPress site. Successful exploitation can compromise confidentiality, integrity, and availability of the affected site. The issue requires user interaction, typically achieved by luring an authenticated administrator to a malicious page.

Critical Impact
Attackers can perform privileged actions on behalf of an authenticated administrator, leading to full compromise of the WordPress site running the Book Landing Page theme.

Affected Products

Rara Theme Book Landing Page (WordPress theme)
All versions from initial release through 1.2.3
WordPress sites with the vulnerable theme installed and active

Discovery Timeline

2024-06-21 - CVE-2024-37230 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-37230

Vulnerability Analysis

The Book Landing Page theme fails to properly validate the origin and authenticity of state-changing HTTP requests. Without a valid anti-CSRF token check, the theme processes requests that originate from any external site as if they were legitimate. An attacker hosts a crafted page containing a hidden form or scripted request that targets a vulnerable endpoint in the theme. When an authenticated WordPress user visits the malicious page, the browser automatically attaches session cookies, and the request executes with the victim's privileges. The attack vector is network-based and requires user interaction, but no privileges are required from the attacker.

Root Cause

The root cause is missing or insufficient CSRF protection on theme-controlled endpoints. WordPress provides nonce APIs such as wp_nonce_field() and check_admin_referer() to defend against forged requests. The vulnerable code paths in versions through 1.2.3 do not implement these validations, allowing forged POST requests to be processed without verification.

Attack Vector

Exploitation requires an authenticated user, most often an administrator, to visit attacker-controlled content while a valid WordPress session is active. The attacker delivers the malicious link through phishing, a comment, or an embedded iframe on a third-party site. Upon page load, the browser issues the forged request against the WordPress site, which is then processed under the victim's identity. Depending on the targeted endpoint, the attacker can modify theme settings or trigger actions that lead to broader site compromise.

No public proof-of-concept code is available for this CVE. Refer to the Patchstack Vulnerability Advisory for additional technical context.

Detection Methods for CVE-2024-37230

Indicators of Compromise

Unexpected modifications to theme options, widgets, or site configuration without a corresponding admin login event
HTTP POST requests to theme endpoints with Referer headers pointing to external, untrusted domains
Administrator session activity originating from pages loaded outside the WordPress admin dashboard

Detection Strategies

Review web server access logs for state-changing requests to theme endpoints lacking a same-origin Referer or Origin header
Audit WordPress activity logs for configuration changes that do not correlate with explicit administrator actions
Compare the installed Book Landing Page version against 1.2.3 and flag any installation at or below that version

Monitoring Recommendations

Enable a WordPress activity logging plugin to capture theme option changes and administrative actions
Monitor for outbound clicks from administrator accounts to untrusted external URLs while sessions are active
Alert on changes to theme files, settings tables, and wp_options entries related to the Book Landing Page theme

How to Mitigate CVE-2024-37230

Immediate Actions Required

Update the Rara Theme Book Landing Page to a version newer than 1.2.3 as soon as a patched release is available from the vendor
Restrict administrator accounts from browsing untrusted sites while logged into WordPress
Enforce short session lifetimes and require re-authentication for sensitive theme and site configuration changes

Patch Information

At the time of the NVD entry, the advisory lists affected versions through 1.2.3. Review the Patchstack Vulnerability Advisory for the current fixed version and apply the vendor update through the WordPress theme management interface.

Workarounds

Deactivate and remove the Book Landing Page theme until a patched version is installed
Deploy a web application firewall (WAF) rule that blocks cross-origin POST requests to WordPress theme endpoints
Require administrators to use a dedicated browser profile for WordPress administration to reduce CSRF exposure

bash

# Example WAF rule concept: block cross-origin POSTs to wp-admin without same-origin Referer
# (Adapt syntax to your WAF or reverse proxy)
SecRule REQUEST_METHOD "@streq POST" \
  "chain,deny,status:403,id:1003722,msg:'Blocked cross-origin POST to wp-admin (CVE-2024-37230 mitigation)'"
  SecRule REQUEST_URI "@beginsWith /wp-admin/" \
    "chain"
    SecRule REQUEST_HEADERS:Referer "!@beginsWith https://your-site.example/" "t:none"