CVE-2021-30224
📋 TL;DR
This CSRF vulnerability in Rukovoditel v2.8.3 allows attackers to trick authenticated administrators into unknowingly creating new admin accounts with attacker-controlled credentials. Any organization using the vulnerable version of Rukovoditel project management software is affected, particularly those with internet-facing installations.
💻 Affected Systems
- Rukovoditel
📦 What is this software?
Rukovoditel by Rukovoditel
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the Rukovoditel instance with attacker creating persistent admin accounts, leading to data theft, system manipulation, and potential lateral movement to other systems.
Likely Case
Attackers create hidden admin accounts to maintain persistent access, steal sensitive project data, and potentially modify system configurations.
If Mitigated
With proper CSRF protections and network segmentation, impact is limited to the Rukovoditel application only, preventing lateral movement.
🎯 Exploit Status
Exploitation requires tricking an authenticated admin into visiting a malicious page. Proof-of-concept code is publicly available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v2.8.4 or later
Vendor Advisory: https://forum.rukovoditel.net/viewtopic.php?f=19&t=2760
Restart Required: No
Instructions:
1. Backup your Rukovoditel installation and database. 2. Download the latest version from the official Rukovoditel website. 3. Replace the existing installation files with the updated version. 4. Verify the update by checking the version in the admin panel.
🔧 Temporary Workarounds
CSRF Token Implementation
allManually add CSRF tokens to admin user creation forms
SameSite Cookie Enforcement
allConfigure session cookies with SameSite=Strict attribute
Set-Cookie: session=value; SameSite=Strict; Secure; HttpOnly
🧯 If You Can't Patch
- Implement strict network access controls to limit Rukovoditel access to trusted IP addresses only
- Require multi-factor authentication for all admin accounts and monitor for unusual admin user creation
🔍 How to Verify
Check if Vulnerable:
Check if your Rukovoditel version is 2.8.3 by logging into admin panel and viewing version informationCheck Version:
Check admin panel dashboard or login page footer for version informationVerify Fix Applied:
After updating, verify version shows 2.8.4 or later and test that CSRF tokens are present in admin user creation forms📡 Detection & Monitoring
Log Indicators:
- Unexpected admin user creation events
- Multiple failed login attempts followed by successful admin login from new user
Network Indicators:
- HTTP POST requests to user creation endpoints without proper referrer headers
- Unusual traffic patterns to admin interfaces
SIEM Query:
source="rukovoditel_logs" AND (event="user_created" AND user_role="admin") | stats count by src_ip, user