CVE-2024-0358: Csdeshang Dso2o Auth Bypass Vulnerability

CVE-2024-0358 Overview

CVE-2024-0358 is an improper access control vulnerability [CWE-284] affecting DeShang DSO2O versions up to 4.1.0. The flaw resides in the /install/install.php script, which fails to restrict access after initial deployment. Remote attackers can reach the installation endpoint without authentication and manipulate application state. The vulnerability was assigned VulDB identifier VDB-250125, and a public proof-of-concept has been disclosed. The issue is exploitable over the network with low attack complexity and no user interaction.

Critical Impact
Unauthenticated remote attackers can access the exposed installation script in DSO2O ≤ 4.1.0, leading to confidentiality impact on affected e-commerce deployments.

Affected Products

DeShang DSO2O versions up to and including 4.1.0
Deployments exposing /install/install.php after setup
csdeshang dso2o open-source e-commerce platform

Discovery Timeline

2024-01-10 - CVE-2024-0358 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-0358

Vulnerability Analysis

The vulnerability is classified under [CWE-284] Improper Access Control. DeShang DSO2O ships an installation script at /install/install.php that remains reachable after the initial setup completes. The application does not enforce a post-install lockdown, such as a filesystem flag or removal of the installer.

Because the installer performs privileged application-configuration operations, exposing it to unauthenticated requests undermines the security posture of the entire deployment. An attacker reaching the endpoint can interact with logic that should only run during first-time provisioning.

The EPSS score is 0.628% (45.5 percentile), indicating a moderate probability of exploitation activity within the next 30 days. A public proof-of-concept has been shared on Zhao Jin's PoC repository, lowering the barrier for opportunistic attackers.

Root Cause

The root cause is missing authorization on the installation handler. Web installers typically require a one-time execution guard, either through a lock file (install.lock), a database-populated flag, or explicit removal of the installer after setup. DSO2O ≤ 4.1.0 lacks such a control, allowing repeated invocation of /install/install.php by any network client.

Attack Vector

Exploitation occurs over the network without credentials or user interaction. An attacker sends an HTTP request directly to /install/install.php on a target DSO2O instance. Automated scanners can enumerate exposed installers across the internet and issue requests programmatically. The impact is confidentiality-focused, with no direct integrity or availability degradation reflected in the CVSS vector.

Refer to the Zhao Jin PoC Share and VulDB entry #250125 for technical details on the disclosed exploitation path.

Detection Methods for CVE-2024-0358

Indicators of Compromise

HTTP requests to /install/install.php on production DSO2O hosts after initial deployment
Presence of an accessible installer file returning HTTP 200 rather than 403/404
Unexpected modifications to DSO2O configuration files or database credentials
Web server access logs showing external IPs probing install.php paths

Detection Strategies

Baseline the DSO2O web root and alert on any post-deployment access to installer scripts
Deploy web application firewall rules that block or log requests matching /install/install.php
Correlate access-log entries against known scanner user agents and source IP reputation feeds

Monitoring Recommendations

Continuously monitor HTTP request patterns targeting installation endpoints across all internet-facing DSO2O instances
Track configuration-file modification timestamps and hash values for tamper evidence
Aggregate web server logs into a centralized store and alert on 2xx responses from /install/ paths

How to Mitigate CVE-2024-0358

Immediate Actions Required

Delete or rename /install/install.php on every DSO2O deployment that has completed initial setup
Restrict access to the /install/ directory at the web server layer using IP allow-listing or authentication
Audit web-server access logs for prior unauthenticated requests to install.php and rotate any exposed secrets
Upgrade to a fixed release once the vendor publishes one; monitor the VulDB advisory for status

Patch Information

No vendor patch or fixed version was listed in the referenced advisories at the time of NVD publication. Operators must apply configuration-level mitigations until DeShang releases a corrected build. Track the vendor's project releases for updates addressing the installer-exposure issue.

Workarounds

Remove the installer file after setup: rm -f /var/www/dso2o/install/install.php
Block the installer path in the web server configuration to return HTTP 403 for all requests
Place the DSO2O admin and installation paths behind a VPN or IP allow-list until a patched release is available

bash

# Nginx configuration to block installer access
location ~ ^/install/install\.php$ {
    deny all;
    return 403;
}

# Apache equivalent (.htaccess in /install/)
<Files "install.php">
    Require all denied
</Files>