CVE-2024-28405

Executive Summary

CVE-2024-28405 is an Incorrect Access Control vulnerability in SEMCMS 4.8. The core issue lies in the application’s authentication flow: the file SEMCMS_Funtion.php is included and executed before the admin user’s session is validated. This allows an unauthenticated attacker to bypass the login check and gain administrative privileges by directly accessing admin pages. The vulnerability has a CVSS score of 0.0 (likely unassigned or placeholder), but the impact is critical as it leads to full administrative control of the CMS. No official patch has been released, and no public exploit code or Nuclei template is available at this time.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Unassigned / Placeholder)
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Threat Level: Critical (Estimated)

Rationale: The vulnerability allows an unauthenticated remote attacker to gain admin access without any user interaction. The attack complexity is low, and the impact on confidentiality, integrity, and availability is high.

Deep Dive & Mechanics

The vulnerability is rooted in the improper ordering of authentication checks in SEMCMS 4.8. The application’s admin pages include SEMCMS_Funtion.php at the top of the script. This file contains critical functions and database connections. However, the authentication verification (checking if the user is a valid admin) is performed after the inclusion of SEMCMS_Funtion.php. This means that an attacker can directly request an admin page (e.g., admin/index.php), and the code will execute SEMCMS_Funtion.php before verifying the user’s session. Since the authentication check is bypassed, the attacker gains full admin privileges.

Attack Flow:

1. Attacker identifies a SEMCMS 4.8 instance.
2. Attacker sends a direct HTTP request to an admin page (e.g., /admin/index.php).
3. The server includes SEMCMS_Funtion.php and executes its code.
4. The authentication check (which should have been performed earlier) is either skipped or fails to block the request.
5. The attacker is granted admin-level access to the CMS.

Vulnerable vs. Patched Code

Vulnerable Code (SEMCMS 4.8):

<?php
// admin/index.php (vulnerable)
include('SEMCMS_Funtion.php');
// ... other code ...
// Authentication check happens AFTER inclusion
if (!check_admin()) {
    // redirect to login
}
?>

Patched Code (Hypothetical):

<?php
// admin/index.php (patched)
// Authentication check BEFORE inclusion
if (!check_admin()) {
    header('Location: login.php');
    exit;
}
include('SEMCMS_Funtion.php');
// ... other code ...
?>

Explanation: The fix requires moving the authentication check to the very beginning of the admin page, before any includes or function calls. This ensures that only authenticated users can access the admin functionality.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A running instance of SEMCMS 4.8.
• Network access to the admin panel.

Exploitation Steps:

1. Identify the target URL (e.g., http://target.com/semcms/admin/).
2. Send a direct HTTP GET request to an admin page:

   curl -v http://target.com/semcms/admin/index.php
   

3. If the vulnerability exists, the response will contain the admin dashboard HTML without requiring authentication.
4. The attacker can then perform admin actions (e.g., upload files, modify settings, execute SQL queries).

Proof of Concept (PoC):

# Simple PoC to check for vulnerability
curl -s -o /dev/null -w "%{http_code}" http://target.com/semcms/admin/index.php
# If response is 200 and contains admin content, the vulnerability is present.

Blue Team (Detection & Defense)

Detection:

• Monitor for direct requests to admin pages (e.g., /admin/index.php, /admin/login.php) from IPs that are not in the admin whitelist.
• Look for anomalous access patterns, such as a single IP accessing multiple admin pages without a prior login.
• Check server logs for requests to SEMCMS_Funtion.php from unauthenticated sessions.

Defense:

• Apply the patch by moving the authentication check before the include of SEMCMS_Funtion.php.
• Implement a Web Application Firewall (WAF) rule to block direct access to admin pages without a valid session cookie.
• Restrict admin access to specific IP addresses or VPN.

Indicators of Compromise (IOCs)

• File: SEMCMS_Funtion.php (included before authentication)
• URL Pattern: /admin/index.php, /admin/*.php accessed without prior login
• Log Entry: HTTP 200 responses to admin pages from unauthenticated users
• Network: Unusual traffic to /admin/ paths from non-admin IPs

Detection Engineering

YARA Rule

rule CVE_2024_28405_SEMCMS_AccessControl
{
    meta:
        description = "Detects vulnerable SEMCMS 4.8 files with incorrect access control"
        author = "Valters IT"
        date = "2024-03-01"
        reference = "CVE-2024-28405"
    strings:
        $vuln_pattern = "include('SEMCMS_Funtion.php');"
        $auth_check = "check_admin()"
    condition:
        $vuln_pattern and not $auth_check at (0..100)
}

Sigma Rule

title: CVE-2024-28405 - SEMCMS Incorrect Access Control
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects direct access to SEMCMS admin pages without prior authentication
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem:
            - '/admin/index.php'
            - '/admin/*.php'
        sc-status: 200
    filter:
        cs-uri-query: 'login*'
    condition: selection and not filter
falsepositives:
    - Legitimate admin users
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-28405 - SEMCMS Admin Access Bypass";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"/admin/"; http_uri;
    pcre:"/\/admin\/(index|login|dashboard)\.php/i";
    sid:1000001;
    rev:1;
    reference:cve,2024-28405;
)

Remediation & Mitigation

Immediate Actions:

1. Patch the code: Move the authentication check to the top of every admin page, before any includes.
2. Restrict access: Use .htaccess or firewall rules to limit admin panel access to trusted IPs.
3. Monitor logs: Review web server logs for unauthorized admin access attempts.

Long-term Fix:

• Upgrade to a patched version of SEMCMS (if available) or migrate to a more secure CMS.
• Implement a proper authentication framework (e.g., session-based with CSRF tokens).
• Conduct a security audit of the entire application.

Workaround:

• If patching is not possible, disable the admin panel or place it behind a VPN.

Valters IT