CVE-2021-24823
📋 TL;DR
The Support Board WordPress plugin before version 3.3.6 lacks CSRF protection in its AJAX handlers, allowing attackers to trick logged-in administrators into performing unauthorized actions. This vulnerability affects WordPress sites using the vulnerable plugin version, potentially leading to arbitrary file deletion or other malicious operations.
💻 Affected Systems
- Support Board WordPress Plugin
📦 What is this software?
Support Board by Schiocco
⚠️ Risk & Real-World Impact
Worst Case
Attackers could delete critical WordPress files, leading to site disruption, data loss, or privilege escalation to remote code execution through file manipulation.
Likely Case
Attackers would use CSRF to make administrators delete files, potentially disrupting site functionality or enabling further attacks.
If Mitigated
With proper CSRF protections and user awareness, exploitation would be prevented even if the vulnerable plugin is installed.
🎯 Exploit Status
Exploitation requires tricking a logged-in administrator into visiting a malicious page. The vulnerability is well-documented with public proof-of-concept details available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.3.6
Vendor Advisory: https://wpscan.com/vulnerability/1bdebd9e-a7f2-4f55-b5b0-185eb619ebaf
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find 'Support Board' and check if version is below 3.3.6. 4. Click 'Update Now' if available, or manually update via FTP by replacing plugin files with version 3.3.6 or later.
🔧 Temporary Workarounds
Temporary Plugin Deactivation
allDeactivate the Support Board plugin until patched to prevent exploitation.
wp plugin deactivate support-board
CSRF Protection Middleware
allImplement custom CSRF protection at the web server or application level for AJAX endpoints.
🧯 If You Can't Patch
- Implement strict access controls and limit administrator sessions to trusted networks only.
- Use web application firewalls (WAF) with CSRF protection rules and monitor for suspicious AJAX requests to include/ajax.php.
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel under Plugins > Installed Plugins for Support Board version. If version is below 3.3.6, the site is vulnerable.Check Version:
wp plugin get support-board --field=versionVerify Fix Applied:
After updating, verify the Support Board plugin shows version 3.3.6 or higher in the WordPress plugins list.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /wp-content/plugins/support-board/include/ajax.php from unexpected sources
- Multiple file deletion events in WordPress or server logs
Network Indicators:
- CSRF attack patterns targeting AJAX endpoints without referrer validation
- Suspicious redirects or iframe loads in administrator sessions
SIEM Query:
source="wordpress.log" AND "include/ajax.php" AND ("DELETE" OR "unlink" OR "rm")🔗 References
- https://noob3xploiter.medium.com/support-board-3-3-4-arbitrary-file-deletion-to-remote-code-execution-da4c45b45c83
- https://wpscan.com/vulnerability/1bdebd9e-a7f2-4f55-b5b0-185eb619ebaf
- https://noob3xploiter.medium.com/support-board-3-3-4-arbitrary-file-deletion-to-remote-code-execution-da4c45b45c83
- https://wpscan.com/vulnerability/1bdebd9e-a7f2-4f55-b5b0-185eb619ebaf
