CVE-2024-46086
📋 TL;DR
This CSRF vulnerability in FrogCMS allows attackers to trick authenticated administrators into performing unauthorized file deletion actions. Attackers can craft malicious requests that delete files when administrators visit compromised pages. All FrogCMS administrators using the vulnerable version are affected.
💻 Affected Systems
- FrogCMS
📦 What is this software?
Frogcms by Frogcms Project
⚠️ Risk & Real-World Impact
Worst Case
Complete website defacement or data loss through deletion of critical system files, potentially causing service disruption and requiring full restoration from backups.
Likely Case
Selective deletion of website content files, images, or configuration files leading to broken functionality and content loss.
If Mitigated
No impact if proper CSRF protections are implemented or if administrators use separate accounts for browsing and administration.
🎯 Exploit Status
Exploitation requires the victim to be authenticated as an administrator and visit a malicious page while logged in.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a newer version if available or implementing CSRF protections manually.
🔧 Temporary Workarounds
Implement CSRF Tokens
allAdd CSRF token validation to the file_manager delete endpoint
Modify /admin/?/plugin/file_manager/delete/ endpoint to require and validate CSRF tokens
Disable File Manager Plugin
allTemporarily disable the vulnerable file_manager plugin
Remove or rename the file_manager plugin directory
🧯 If You Can't Patch
- Implement strict SameSite cookie policies and require re-authentication for sensitive actions
- Use separate browser profiles or accounts for administrative tasks versus regular browsing
🔍 How to Verify
Check if Vulnerable:
Check if FrogCMS version is 0.9.5 and file_manager plugin is accessible at /admin/?/plugin/file_manager/Check Version:
Check FrogCMS version in admin panel or configuration filesVerify Fix Applied:
Test that file deletion requests require CSRF tokens and fail without proper validation📡 Detection & Monitoring
Log Indicators:
- Multiple file deletion requests from same admin session without corresponding page views
- File deletion requests without referrer headers
Network Indicators:
- POST requests to /admin/?/plugin/file_manager/delete/ without CSRF tokens
- Cross-origin requests to the delete endpoint
SIEM Query:
source="web_logs" AND uri="/admin/?/plugin/file_manager/delete/" AND NOT referrer CONTAINS "admin"