CVE-2024-54851
📋 TL;DR
Teedy versions up to 1.12 lack CSRF protection, allowing attackers to trick authenticated users into performing unintended actions. This affects all Teedy instances running vulnerable versions, potentially compromising document management systems.
💻 Affected Systems
- Teedy
📦 What is this software?
Teedy by Sismics
⚠️ Risk & Real-World Impact
Worst Case
Attackers could manipulate document access controls, delete critical documents, or modify user permissions through forged requests executed by authenticated administrators.
Likely Case
Attackers could trick users into uploading malicious documents, modifying metadata, or changing sharing settings through crafted links or forms.
If Mitigated
With proper CSRF tokens and same-site cookie policies, exploitation requires significantly more sophisticated social engineering or additional vulnerabilities.
🎯 Exploit Status
Exploitation requires the victim to be authenticated and visit a malicious page while logged into Teedy. No authentication bypass needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: > 1.12
Vendor Advisory: https://github.com/Tanguy-Boisset/CVE/blob/master/CVE-2024-54851/README.md
Restart Required: No
Instructions:
1. Upgrade Teedy to version > 1.12. 2. Verify CSRF protection is enabled in application configuration. 3. Clear browser caches after upgrade.
🔧 Temporary Workarounds
Implement CSRF tokens manually
allAdd CSRF token validation to all state-changing endpoints
Modify application code to include CSRF tokens in forms and validate them server-side
SameSite cookie enforcement
allConfigure session cookies with SameSite=Strict attribute
Set session.cookie_samesite = 'Strict' in Teedy configuration
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to detect and block CSRF attempts
- Restrict Teedy access to internal networks only and implement strict access controls
🔍 How to Verify
Check if Vulnerable:
Check Teedy version in admin panel or via version file. If version <= 1.12, test for CSRF protection by attempting to submit forms without tokens.Check Version:
Check /version endpoint or admin dashboard for version informationVerify Fix Applied:
After upgrade, verify forms include CSRF tokens and requests without valid tokens are rejected.📡 Detection & Monitoring
Log Indicators:
- Multiple failed state-changing requests from same IP
- Requests missing expected CSRF tokens
- Unusual document modification patterns
Network Indicators:
- HTTP POST requests without Referer headers matching origin
- Cross-origin requests to state-changing endpoints
SIEM Query:
source="teedy" AND (http_method="POST" OR http_method="PUT" OR http_method="DELETE") AND NOT csrf_token=*