CVE-2021-37366
📋 TL;DR
CVE-2021-37366 is a CSRF vulnerability in CTparental's admin panel that, when combined with XSS, allows attackers to trick administrators into disabling filtering for all standard users. This affects CTparental installations before version 4.45.03. Administrators who access malicious links while logged into the admin panel are vulnerable.
💻 Affected Systems
- CTparental
📦 What is this software?
Ctparental by Ctparental Project
⚠️ Risk & Real-World Impact
Worst Case
All user filtering is disabled, allowing unrestricted internet access for all standard users, potentially exposing them to malicious content or bypassing organizational policies.
Likely Case
Targeted attacks against administrators lead to temporary or permanent disabling of filtering for specific users or groups.
If Mitigated
With proper CSRF protections and admin awareness, exploitation attempts are blocked or ineffective.
🎯 Exploit Status
Exploitation requires administrator to click a malicious link while authenticated. Combined CSRF/XSS attack chain is documented in public references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.45.03
Vendor Advisory: https://gitlab.com/marsat/CTparental/
Restart Required: Yes
Instructions:
1. Backup current configuration. 2. Update CTparental to version 4.45.03 or later via package manager or manual installation. 3. Restart CTparental service. 4. Verify version update.
🔧 Temporary Workarounds
Implement CSRF Tokens
linuxAdd CSRF protection tokens to admin panel forms manually if unable to patch immediately.
Manual code modification required - refer to CTparental documentation
Restrict Admin Panel Access
linuxLimit admin panel access to specific IP addresses or networks.
iptables -A INPUT -p tcp --dport [admin_port] -s [trusted_ip] -j ACCEPT
iptables -A INPUT -p tcp --dport [admin_port] -j DROP
🧯 If You Can't Patch
- Educate administrators about phishing risks and never clicking untrusted links while authenticated.
- Implement web application firewall (WAF) rules to detect and block CSRF attempts.
🔍 How to Verify
Check if Vulnerable:
Check CTparental version: if below 4.45.03, system is vulnerable.Check Version:
ctparental --version or check package manager (apt list --installed | grep ctparental)Verify Fix Applied:
Confirm version is 4.45.03 or higher and test admin panel forms for CSRF tokens.📡 Detection & Monitoring
Log Indicators:
- Unexpected filtering disable events in CTparental logs
- Admin panel access from unusual IP addresses
Network Indicators:
- HTTP POST requests to admin endpoints without referrer headers or CSRF tokens
SIEM Query:
source="ctparental.log" AND (event="filter_disabled" OR event="admin_action")