CVE-2024-24764

Executive Summary

CVE-2024-24764 is a low-severity (CVSS 3.5) open redirect vulnerability affecting October CMS, a self-hosted platform built on Laravel. The flaw resides in the PageFinder link schema resolver (october://), which improperly allowed external URLs. An authenticated administrator could be tricked into clicking a crafted link that redirects them to an untrusted external site, enabling phishing or credential theft. The vulnerability is patched in version 3.5.15. No public exploit code or PoC is available, and the EPSS score is 0.0%, indicating low exploitation likelihood.

Supply Chain & Package Security

October CMS is a PHP/Laravel-based CMS distributed via Composer. The vulnerability is in the core application code, not in a third-party package. However, administrators should verify their Composer dependencies are up-to-date and that the application is not running a forked or modified version of the core.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): High (H) – Requires authenticated administrator access.
• User Interaction (UI): Required (R) – Victim must click a crafted link.
• Scope (S): Unchanged (U) – The redirect does not affect other components.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): Low (L) – The redirect can lead to a malicious site.
• Availability (A): None (N) – No impact on availability.

Threat Level: Low. The requirement for admin privileges and user interaction significantly reduces the risk. However, in a social engineering context, an attacker could use this to harvest admin credentials.

Deep Dive & Mechanics

The vulnerability exists in the PageFinder component, which handles the october:// URI scheme. This scheme is used internally to link to pages within the CMS. The resolver did not validate whether the target URL was within the same host, allowing an attacker to craft a link like:

october://evil.com/phishing

When an authenticated admin clicks this link, the application redirects them to evil.com. The attacker could use this in a phishing campaign to steal session cookies or credentials by presenting a fake login page.

The root cause is a missing host validation check in the resolvePageFinderLink method. The code likely used a simple string concatenation or a redirect() helper without verifying the host.

Vulnerable vs. Patched Code

Vulnerable Code (before 3.5.15):

// In PageFinder.php or similar
public function resolveLink($schema, $path)
{
    // No host validation
    return redirect($path);
}

Patched Code (3.5.15):

public function resolveLink($schema, $path)
{
    // Ensure the path is relative or internal
    if (Url::isValidUrl($path) && !Url::isInternal($path)) {
        throw new ApplicationException('Invalid redirect.');
    }
    return redirect($path);
}

The patch adds a check using Url::isInternal() to block external URLs. The Url helper is part of Laravel's core.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to an October CMS instance with admin credentials.
• Ability to craft a malicious link.

Exploitation Steps:

1. Craft a link: october://attacker.com/fake-login
2. Send the link to an authenticated admin via email or chat.
3. The admin clicks the link and is redirected to attacker.com/fake-login.
4. The attacker's site mimics the October CMS login page.
5. The admin enters credentials, which are captured by the attacker.

No public exploit code is available. The attack is purely social engineering.

Blue Team

Detection:

• Monitor for unusual october:// links in logs or user activity.
• Look for redirects to external domains in web server logs.
• Use the Sigma rule below to detect suspicious redirect patterns.

Prevention:

• Apply the patch immediately (upgrade to 3.5.15+).
• Implement Content Security Policy (CSP) headers to restrict redirects.
• Educate administrators about phishing risks.

Indicators of Compromise (IOCs)

• URL Pattern: october://* where * is an external domain.
• Web Server Logs: GET /october://evil.com or similar redirect requests.
• User Agent: No specific UA; any browser.
• Referer: May contain the malicious link.

Detection Engineering

YARA Rule

rule CVE_2024_24764_October_Open_Redirect {
    meta:
        description = "Detects open redirect attempts via october:// schema"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-24764"
    strings:
        $october_schema = "october://"
        $external_domain = /october:\/\/[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/
    condition:
        $october_schema and $external_domain
}

Sigma Rule

title: October CMS Open Redirect via october:// Schema
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests containing the october:// schema pointing to external domains
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: "october://"
    condition: selection
falsepositives:
    - Legitimate internal links (should be rare)
level: low

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-24764 October CMS Open Redirect"; flow:to_server; content:"october://"; http_uri; pcre:"/october:\/\/[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade to October CMS version 3.5.15 or later.
2. Workaround: If upgrade is not possible, modify the PageFinder resolver to validate the host. Add a check like:

   if (Url::isValidUrl($path) && !Url::isInternal($path)) {
       throw new Exception('Invalid redirect.');
   }
   

3. Long-term: Implement a web application firewall (WAF) rule to block october:// requests with external domains.
4. Monitoring: Enable logging for all redirects and review for anomalies.

Valters IT
DevSecOps & Cyber Threat Intelligence