CVE-2020-22761
📋 TL;DR
This CVE describes a Cross-Site Request Forgery (CSRF) vulnerability in FlatPress 1.1 that allows attackers to trick authenticated administrators into performing unauthorized file deletions via the DeleteFile function. Attackers can craft malicious web pages that, when visited by logged-in administrators, automatically send requests to delete files on the FlatPress server. This affects all FlatPress 1.1 installations with administrative access.
💻 Affected Systems
- FlatPress
📦 What is this software?
Flatpress by Flatpress
⚠️ Risk & Real-World Impact
Worst Case
Complete website defacement or data loss through deletion of critical files, potentially including configuration files, content files, or the entire installation.
Likely Case
Partial content deletion leading to website disruption, loss of blog posts, media files, or configuration settings.
If Mitigated
No impact if proper CSRF protections are implemented or if administrators don't visit malicious sites while authenticated.
🎯 Exploit Status
Exploitation requires social engineering to get authenticated administrators to visit malicious pages.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.1.1
Vendor Advisory: https://github.com/flatpressblog/flatpress/issues/64
Restart Required: No
Instructions:
1. Download FlatPress 1.1.1 from official repository. 2. Backup current installation. 3. Replace affected files with patched versions. 4. Verify functionality.
🔧 Temporary Workarounds
CSRF Token Implementation
allAdd CSRF tokens to the DeleteFile function in admin.php
Edit flat/admin.php to include CSRF token validation before file deletion operations
Restrict Admin Access
allLimit administrative access to trusted networks only
Configure firewall rules to restrict /admin/ paths to internal IPs
🧯 If You Can't Patch
- Implement strict SameSite cookie policies and require re-authentication for sensitive actions
- Use browser extensions that block CSRF attempts and educate administrators about phishing risks
🔍 How to Verify
Check if Vulnerable:
Check if running FlatPress 1.1 by examining version in admin panel or checking flatpress/version.txtCheck Version:
cat flatpress/version.txtVerify Fix Applied:
Verify installation is version 1.1.1 or later, and test that CSRF tokens are required for file deletion actions📡 Detection & Monitoring
Log Indicators:
- Multiple file deletion requests from same admin session without corresponding page loads
- DELETE requests to admin.php without referrer headers
Network Indicators:
- HTTP requests to /flat/admin.php with deletefile parameter from unexpected referrers
SIEM Query:
source="web_logs" AND uri="/flat/admin.php" AND method="POST" AND params="deletefile" AND NOT referrer CONTAINS "yourdomain.com"