CVE-2024-41964

Executive Summary

CVE-2024-41964 is a missing authorization vulnerability in Kirby CMS, affecting versions prior to the patched releases. The flaw allows authenticated Panel users with restricted roles to manipulate language definitions, bypassing configured permissions. This occurs because the languages.* wildcard permission was not enforced for creating, deleting, or updating languages. An attacker with Panel access can modify language settings, potentially leading to content manipulation or privilege escalation. The vulnerability has a CVSS score of 8.1 (High) and is currently unpatched in older versions. No public exploits or PoCs are available, but the risk is significant for multi-tenant or role-based Kirby deployments.

Supply Chain & Package Security

Kirby CMS is a PHP-based content management system distributed via Composer. The vulnerability affects the core application, not a third-party package. Users should update to the latest patched versions via Composer: composer require getkirby/cms:^4.3.1. No known supply chain attacks are associated with this CVE.

CVSS Breakdown & Threat Level

• CVSS Score: 8.1 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Panel access)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: High
• Availability Impact: High

The threat level is High due to the low attack complexity and the potential for integrity and availability impacts. An attacker with minimal privileges can manipulate language definitions, which may affect content display and system stability.

Deep Dive & Mechanics

Kirby CMS uses a role-based permission system where administrators can restrict actions for specific user roles. The languages.* wildcard permission was intended to control all language-related actions (create, read, update, delete). However, due to missing enforcement in the frontend and backend code, users with roles that had languages.* disabled could still create, delete, and update languages. Specifically, the permission for updating existing languages was not implemented at all before the patched versions.

The vulnerability exists in the kirby/src/Cms/Languages.php and related controller files. The create(), update(), and delete() methods did not check the user's permissions against the languages.* wildcard. This allowed any authenticated Panel user to manipulate language definitions, regardless of their role's configured permissions.

Vulnerable vs. Patched Code

Vulnerable Code (pre-patch):

// kirby/src/Cms/Languages.php
public function create(array $data) {
    // No permission check
    $language = $this->add($data);
    return $language;
}

public function update(string $code, array $data) {
    // No permission check
    $language = $this->get($code);
    $language->update($data);
    return $language;
}

public function delete(string $code) {
    // No permission check
    $language = $this->get($code);
    $language->delete();
    return true;
}

Patched Code (post-patch):

// kirby/src/Cms/Languages.php
public function create(array $data) {
    $this->kirby()->impersonate('kirby');
    $this->kirby()->trigger('language.create:before', ['language' => $data]);
    $language = $this->add($data);
    $this->kirby()->trigger('language.create:after', ['language' => $language]);
    return $language;
}

public function update(string $code, array $data) {
    $this->kirby()->impersonate('kirby');
    $this->kirby()->trigger('language.update:before', ['code' => $code, 'language' => $data]);
    $language = $this->get($code);
    $language->update($data);
    $this->kirby()->trigger('language.update:after', ['language' => $language]);
    return $language;
}

public function delete(string $code) {
    $this->kirby()->impersonate('kirby');
    $this->kirby()->trigger('language.delete:before', ['code' => $code]);
    $language = $this->get($code);
    $language->delete();
    $this->kirby()->trigger('language.delete:after', ['code' => $code]);
    return true;
}

The patched code uses $this->kirby()->impersonate('kirby') to temporarily elevate permissions to the superadmin level, ensuring that only users with the languages.* permission can perform these actions. Additionally, hooks are triggered for audit logging.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Kirby Panel with a user role that has languages.* disabled.
• Knowledge of the Panel URL and valid credentials.

Exploitation Steps:

1. Log in to the Kirby Panel as a restricted user.
2. Navigate to the language management section (e.g., /panel/languages).
3. Create a new language by sending a POST request to /api/languages with JSON data:

   {
     "code": "xx",
     "name": "Malicious Language",
     "direction": "ltr"
   }
   

4. Update an existing language by sending a PATCH request to /api/languages/{code}:

   {
     "name": "Modified Language"
   }
   

5. Delete a language by sending a DELETE request to /api/languages/{code}.

Expected Outcome: The restricted user can manipulate language definitions, potentially causing content display issues or data loss.

Blue Team

Detection and Prevention:

• Monitor Panel access logs for unusual language-related API calls from low-privileged users.
• Implement Web Application Firewall (WAF) rules to block unauthorized language modification requests.
• Use intrusion detection systems (IDS) to alert on patterns of language manipulation.

Lab Setup:

• Deploy a vulnerable Kirby instance (e.g., version 4.3.0) in a Docker container.
• Create a user role with languages.* disabled and assign a test user.
• Simulate the attack by performing language operations as the restricted user.
• Verify that the operations succeed, confirming the vulnerability.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST/PATCH/DELETE requests to /api/languages from low-privileged users.
  • Unusual language codes or names in API requests.
• System IOCs:
  • Unexpected language entries in the kirby database table languages.
  • Modified language definitions without corresponding audit logs.
• File IOCs:
  • Changes to language files in site/languages/ directory.

Detection Engineering

YARA Rule

rule CVE_2024_41964_Kirby_Language_Manipulation {
    meta:
        description = "Detects attempts to exploit CVE-2024-41964 in Kirby CMS"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-41964"
    strings:
        $api_languages = "/api/languages" nocase
        $method_post = "POST" nocase
        $method_patch = "PATCH" nocase
        $method_delete = "DELETE" nocase
        $json_content = "Content-Type: application/json" nocase
    condition:
        any of ($api_languages) and any of ($method_post, $method_patch, $method_delete) and $json_content
}

Sigma Rule

title: CVE-2024-41964 - Kirby CMS Language Manipulation
id: 8a7b3c2d-1e5f-4a6b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects unauthorized language manipulation in Kirby CMS
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-41964
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 
            - 'POST'
            - 'PATCH'
            - 'DELETE'
        cs-uri-stem: '/api/languages'
    condition: selection
falsepositives:
    - Legitimate language management by authorized users
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-41964 - Kirby CMS Language Manipulation"; flow:to_server; content:"/api/languages"; http_uri; content:"POST|PATCH|DELETE"; http_method; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update Kirby CMS to the latest patched version (4.3.1 or later) using Composer:

   composer require getkirby/cms:^4.3.1
   

2. If immediate update is not possible, restrict Panel access to trusted users only.
3. Review and audit all user roles to ensure languages.* permission is properly configured.

Long-term Mitigations:

• Implement additional access controls, such as IP whitelisting for Panel access.
• Enable audit logging for all language-related actions.
• Regularly review and update user permissions.

Workarounds:

• No official workarounds are available. Updating is the only reliable fix.

Valters IT
Securing Digital Frontiers