CVE-2024-54368: GitSync Plugin CSRF Vulnerability

CVE-2024-54368 Overview

CVE-2024-54368 is a Cross-Site Request Forgery (CSRF) vulnerability discovered in the GitSync WordPress plugin (git-sync) developed by rubengarzajr. This vulnerability allows attackers to chain CSRF with Code Injection, potentially leading to Remote Code Execution (RCE) on affected WordPress installations. The flaw stems from insufficient CSRF token validation in the plugin's administrative functions.

Critical Impact

Attackers can trick authenticated administrators into executing malicious actions, leading to arbitrary code execution on the WordPress server.

Affected Products

• GitSync WordPress Plugin versions up to and including 1.1.0
• WordPress installations running vulnerable GitSync versions
• Web servers hosting affected WordPress deployments

Discovery Timeline

• 2024-12-16 - CVE-2024-54368 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2024-54368

Vulnerability Analysis

This vulnerability is classified under CWE-352 (Cross-Site Request Forgery). The GitSync plugin fails to properly validate CSRF tokens when processing administrative requests, allowing attackers to craft malicious web pages that, when visited by an authenticated administrator, execute unauthorized actions on their behalf.

The attack chain combines CSRF with Code Injection capabilities. When an administrator visits a malicious page while authenticated to WordPress, the attacker can leverage the GitSync plugin's functionality to inject and execute arbitrary code on the server. This is particularly dangerous because GitSync interacts with Git repositories and system-level operations, providing a pathway for code execution.

Root Cause

The root cause of this vulnerability lies in missing or improperly implemented nonce verification in the GitSync plugin's administrative endpoints. WordPress provides built-in CSRF protection through nonces (number used once), but the affected versions of GitSync do not adequately verify these security tokens before processing sensitive requests. This allows cross-origin requests to be processed as if they were legitimate administrative actions.

Attack Vector

The attack requires social engineering to lure an authenticated WordPress administrator to a malicious website or click a malicious link. The attacker's page contains hidden forms or JavaScript that automatically submits requests to the vulnerable GitSync endpoints. Since the victim's browser includes their WordPress authentication cookies with the request, the server processes it as a legitimate administrative action.

The exploitation does not require direct access to the WordPress installation. An attacker can host the malicious payload on any external server and simply needs to trick an admin into visiting that page while logged into their WordPress dashboard.

Detection Methods for CVE-2024-54368

Indicators of Compromise

• Unexpected Git repository changes or commits on the WordPress server
• Unusual files appearing in WordPress directories, particularly PHP files
• Administrative actions logged without corresponding user activity
• Suspicious outbound connections from the WordPress server
• Modified or new files in the GitSync plugin directory

Detection Strategies

• Monitor WordPress admin action logs for GitSync-related operations without legitimate user sessions
• Implement Content Security Policy (CSP) headers to detect cross-origin form submissions
• Review web server access logs for unusual POST requests to GitSync endpoints
• Enable WordPress audit logging to track plugin configuration changes
• Scan for unexpected PHP files or modifications in the WordPress installation

Monitoring Recommendations

• Deploy web application firewall (WAF) rules to detect CSRF attack patterns
• Monitor file integrity on WordPress installations using GitSync
• Set up alerts for administrative actions occurring outside normal business hours
• Review and audit all Git operations initiated through the plugin
• Implement real-time monitoring for code execution attempts on the server

How to Mitigate CVE-2024-54368

Immediate Actions Required

• Disable or remove the GitSync plugin immediately if running version 1.1.0 or earlier
• Review WordPress server for any signs of compromise or unauthorized code execution
• Audit recent Git repository changes for malicious commits
• Implement additional access controls to limit administrative actions
• Consider using alternative Git synchronization solutions until a patch is available

Patch Information

At the time of publication, users should check the Patchstack WordPress Vulnerability Report for the latest information on available patches. Monitor the official plugin repository for updated versions that address this vulnerability.

Workarounds

• Deactivate the GitSync plugin until a security patch is released
• Implement WAF rules to block suspicious requests to GitSync endpoints
• Restrict administrative access to trusted IP addresses only
• Use browser extensions that prevent automatic form submissions to third-party sites
• Enable two-factor authentication for all WordPress administrator accounts

If disabling the plugin is not immediately possible, consider implementing server-level protections:

# Apache .htaccess rule to restrict GitSync admin endpoints
<IfModule mod_rewrite.c>
    RewriteEngine On
    # Block external referrers from accessing GitSync endpoints
    RewriteCond %{HTTP_REFERER} !^https://your-wordpress-site\.com [NC]
    RewriteRule ^wp-admin/.*git-sync.* - [F,L]
</IfModule>