CVE-2024-30262

Executive Summary

CVE-2024-30262 is a security vulnerability in the Contao open source content management system (CMS). The flaw resides in the session management logic for frontend members. When a user changes their password via the personal data module or the password lost module, the corresponding "remember-me" (persistent login) tokens are not invalidated. This allows an attacker who has previously compromised an account and obtained a valid remember-me token to maintain persistent access to the account even after the legitimate user changes their password. The vulnerability has a CVSS score of 5.9 (Medium), indicating a moderate risk due to the requirement of prior token compromise. The official patch is available in Contao version 4.13.40. As a workaround, administrators can disable the "Allow auto login" feature in the login module.

Supply Chain & Package Security

This vulnerability affects the Contao CMS, which is distributed as a PHP package via Composer (Packagist). The supply chain risk is moderate; users must ensure they update to the patched version (4.13.40) from the official repository. No malicious packages or compromised dependencies have been reported in relation to this CVE.

CVSS Breakdown & Threat Level

• CVSS Score: 5.9 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
• Attack Vector (AV): Network (N) – The attack can be executed remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – The attacker must have already compromised an account and obtained a remember-me token.
• User Interaction (UI): None (N) – No user action is required for exploitation.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): Low (L) – Limited information disclosure (persistent session access).
• Integrity (I): Low (L) – Limited ability to modify data (maintains existing access).
• Availability (A): Low (L) – Limited impact on availability (account remains accessible).

Threat Level: Medium. Exploitation requires prior compromise and token theft, but the impact is persistent unauthorized access.

Deep Dive & Mechanics

The vulnerability is rooted in the session management of Contao's frontend member authentication. The "remember-me" feature stores a persistent token (typically a hash) in a cookie on the user's browser. This token allows the user to remain logged in across browser sessions without re-entering credentials.

Root Cause: When a user changes their password, the application does not invalidate existing remember-me tokens. The token remains valid because it is not tied to the password hash or a token version that changes upon password update.

Attack Flow:

1. Initial Compromise: An attacker compromises a frontend member account (e.g., via phishing, credential stuffing, or another vulnerability).
2. Token Extraction: The attacker extracts the remember-me token from the victim's browser or from a compromised session.
3. Password Change: The legitimate user changes their password (either proactively or due to a forced reset).
4. Persistent Access: The attacker continues to use the stolen remember-me token to authenticate as the user, bypassing the new password.

Technical Detail: The remember-me token is typically stored in a database table (e.g., tl_remember_me) and is validated against the user's session. The token is not linked to the password hash, so a password change does not invalidate it. The fix in version 4.13.40 likely involves deleting all remember-me tokens associated with the user upon password change.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// In password change handler (e.g., PersonalDataController)
public function changePassword($userId, $newPassword) {
    // Update password hash
    $this->database->update('tl_member', ['password' => hash($newPassword)], ['id' => $userId]);
    // Missing: Invalidate remember-me tokens
    // No call to delete tokens from tl_remember_me
}

Patched Code (Conceptual):

// In password change handler (e.g., PersonalDataController)
public function changePassword($userId, $newPassword) {
    // Update password hash
    $this->database->update('tl_member', ['password' => hash($newPassword)], ['id' => $userId]);
    // Invalidate all remember-me tokens for this user
    $this->database->delete('tl_remember_me', ['pid' => $userId]);
}

Key Difference: The patched version explicitly deletes all remember-me tokens associated with the user's ID (pid) from the tl_remember_me table after a password change.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A valid Contao frontend member account (compromised).
• The victim's remember-me token (extracted from browser cookies or session).

Steps:

1. Extract Token: From the victim's browser, locate the REMEMBERME cookie (or similar). The value is the token.
2. Wait for Password Change: The victim changes their password.
3. Re-authenticate: Use the stolen token to authenticate. This can be done by setting the cookie in a browser or using a tool like curl:

   curl -X GET https://target.com/contao/login -b "REMEMBERME=stolen_token_value"
   

4. Verify Access: The server should return the authenticated session without requiring a password.

Note: No public exploit code is available for this CVE. The above is a conceptual demonstration.

Blue Team (Detection & Defense)

Detection:

• Monitor for multiple authentication events using the same remember-me token across different IPs or user agents.
• Alert on password change events followed by immediate re-authentication from a different source.
• Log all remember-me token usage and correlate with password change timestamps.

Defense:

• Apply the patch (upgrade to Contao 4.13.40).
• As a workaround, disable "Allow auto login" in the login module settings.
• Implement additional session management controls, such as token versioning or binding tokens to password hashes.

Indicators of Compromise (IOCs)

• Network:
  • Repeated use of the same REMEMBERME cookie value from different IP addresses.
  • Authentication requests with a valid remember-me token after a password change event.
• Host:
  • Log entries showing password change followed by successful authentication without password.
  • Database entries in tl_remember_me with pid (user ID) that have not been cleared after password change.
• File:
  • No specific file-based IOCs.

Detection Engineering

YARA Rule

rule CVE_2024_30262_RememberMe_Token_Abuse {
    meta:
        description = "Detects potential abuse of remember-me tokens after password change in Contao"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-30262"
    strings:
        $token_cookie = "REMEMBERME"
        $password_change = "tl_member" nocase
        $remember_table = "tl_remember_me" nocase
    condition:
        $token_cookie and ($password_change or $remember_table)
}

Sigma Rule

title: Contao Remember-Me Token Abuse After Password Change
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects multiple authentication events using the same remember-me token after a password change.
author: Valters IT
date: 2024-10-27
references:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-30262
logsource:
    category: application
    product: contao
detection:
    selection:
        event: "authentication"
        cookie: "REMEMBERME"
    timeframe: 1h
    condition: selection | count() by cookie > 1
falsepositives:
    - Legitimate users with multiple devices
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-30262 Contao Remember-Me Token Abuse"; flow:to_server,established; content:"REMEMBERME"; http_cookie; pcre:"/REMEMBERME=[a-f0-9]{32,}/i"; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update Contao to version 4.13.40 or later.
2. Workaround: If immediate upgrade is not possible, disable "Allow auto login" in the login module settings. This prevents the use of remember-me tokens entirely.

Long-Term Measures:

• Implement token versioning or bind tokens to password hashes.
• Conduct a security audit of all session management functions.
• Monitor for any signs of token abuse in logs.

Patch Details:

• Vendor: Contao
• Patch Version: 4.13.40
• Patch URL: https://github.com/contao/contao/releases/tag/4.13.40

Valters IT Signature This report was generated by Valters IT Cyber Threat Intelligence. For questions, contact threatintel@valtersit.com.