CVE-2024-9847
📋 TL;DR
FlatPress CMS has a CSRF vulnerability that allows attackers to enable or disable plugins on behalf of authenticated users. Attackers can craft malicious links that, when clicked by logged-in administrators, perform unauthorized plugin management actions. This affects all FlatPress CMS users running versions before 1.4.dev.
💻 Affected Systems
- FlatPress CMS
📦 What is this software?
Flatpress by Flatpress
⚠️ Risk & Real-World Impact
Worst Case
Attacker disables security plugins or enables malicious plugins, potentially leading to complete system compromise, data theft, or backdoor installation.
Likely Case
Attacker enables/disables plugins to disrupt functionality, deface websites, or create persistent access points for further attacks.
If Mitigated
With proper CSRF protections, the attack fails as requests lack valid tokens, preventing unauthorized plugin changes.
🎯 Exploit Status
Exploitation requires social engineering to trick authenticated users into clicking malicious links.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.4.dev
Vendor Advisory: https://github.com/flatpressblog/flatpress/commit/a81c968f51f134b5e5f9bbe208aa12f4fbc329df
Restart Required: No
Instructions:
1. Backup your FlatPress installation. 2. Download version 1.4.dev from GitHub. 3. Replace existing files with patched version. 4. Verify plugin management functionality works.
🔧 Temporary Workarounds
CSRF Token Implementation
allManually add CSRF tokens to plugin management forms if patching isn't immediately possible.
🧯 If You Can't Patch
- Implement strict SameSite cookie policies for session cookies.
- Use browser extensions that block CSRF attempts or require admin approval for plugin changes.
🔍 How to Verify
Check if Vulnerable:
Check if your FlatPress version is earlier than 1.4.dev by viewing the admin panel or checking version files.Check Version:
Check /fp-interface/version.txt or admin panel dashboard for version information.Verify Fix Applied:
After updating, test plugin management functionality and verify CSRF tokens are present in form requests.📡 Detection & Monitoring
Log Indicators:
- Unexpected plugin enable/disable actions in admin logs
- Multiple failed CSRF token validations
Network Indicators:
- POST requests to plugin management endpoints without Referer headers or CSRF tokens
SIEM Query:
source="flatpress_logs" AND (event="plugin_enabled" OR event="plugin_disabled") AND user_agent="*malicious*"