CVE-2024-35554
📋 TL;DR
CVE-2024-35554 is a Cross-Site Request Forgery vulnerability in idccms v1.35 that allows attackers to trick authenticated administrators into performing unauthorized actions via the /admin/infoWeb_deal.php endpoint. This affects all deployments of idccms v1.35 with administrative interfaces accessible to users.
💻 Affected Systems
- idccms
📦 What is this software?
Idccms by Idccms
⚠️ Risk & Real-World Impact
Worst Case
An attacker could delete website news content or perform other administrative actions without the admin's knowledge, potentially defacing or disrupting the website.
Likely Case
Attackers could delete news content or modify website settings through forged requests when an admin visits a malicious page while logged in.
If Mitigated
With proper CSRF protections, no unauthorized actions can be performed even if an admin visits malicious pages.
🎯 Exploit Status
Exploitation requires the victim admin to be authenticated and visit a malicious page. The GitHub reference shows proof-of-concept details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Implement CSRF tokens in /admin/infoWeb_deal.php and validate them on all state-changing requests.
🔧 Temporary Workarounds
Implement CSRF Protection
allAdd CSRF tokens to all forms and validate them on the server side for the affected endpoint.
Modify /admin/infoWeb_deal.php to include and validate CSRF tokens
Restrict Admin Access
allLimit admin panel access to specific IP addresses or internal networks only.
Configure web server (Apache/Nginx) to restrict /admin/ paths to trusted IPs
🧯 If You Can't Patch
- Implement strict SameSite cookie policies and require re-authentication for sensitive actions
- Monitor admin activity logs for suspicious deletion or modification requests from unexpected sources
🔍 How to Verify
Check if Vulnerable:
Check if /admin/infoWeb_deal.php accepts POST requests without CSRF token validation when performing del operations on newsWeb data.Check Version:
Check CMS version in admin panel or configuration filesVerify Fix Applied:
Test that all state-changing operations in /admin/infoWeb_deal.php require and validate CSRF tokens.📡 Detection & Monitoring
Log Indicators:
- Multiple DELETE/POST requests to /admin/infoWeb_deal.php with mudi=del parameters from unexpected sources
- News content deletions without corresponding admin activity
Network Indicators:
- HTTP requests to /admin/infoWeb_deal.php?mudi=del&dataType=newsWeb from non-admin IPs
- Referer headers pointing to external domains in admin requests
SIEM Query:
source="web_logs" AND uri_path="/admin/infoWeb_deal.php" AND query_string="*mudi=del*" AND NOT src_ip IN (admin_ip_list)