CVE-2024-0880: Qidianbang Qdbcrm CSRF Vulnerability

CVE-2024-0880 Overview

CVE-2024-0880 is a Cross-Site Request Forgery (CSRF) vulnerability in Qidianbang qdbcrm 1.1.0. The flaw affects the Password Reset component, specifically the /user/edit?id=2 endpoint. An attacker can craft a malicious request that, when triggered by an authenticated user, modifies account credentials without consent. The issue is tracked under VulDB identifier VDB-252032 and maps to CWE-352. Public disclosure occurred without vendor response, leaving deployments exposed. The exploit details are publicly documented, increasing the likelihood of opportunistic abuse against internet-facing instances of the application.

Critical Impact
Successful exploitation allows remote attackers to reset another user's password through forged authenticated requests, leading to full account takeover with impact on confidentiality, integrity, and availability.

Affected Products

Qidianbang qdbcrm 1.1.0
Password Reset component (/user/edit?id=2)
CPE: cpe:2.3:a:100296:qdbcrm:1.1.0:*:*:*:*:*:*:*

Discovery Timeline

2024-01-25 - CVE-2024-0880 published to NVD
2024-11-21 - Last updated in NVD database
Vendor was contacted prior to disclosure but did not respond

Technical Details for CVE-2024-0880

Vulnerability Analysis

The vulnerability resides in the user edit functionality of qdbcrm 1.1.0. The /user/edit?id=2 endpoint, used during password reset operations, does not validate the origin of incoming state-changing requests. The application lacks anti-CSRF tokens, custom request headers, or SameSite cookie protections on the session identifier. An authenticated session is sufficient to perform the action, and the server processes the request based solely on the session cookie automatically attached by the browser.

Because the network attack vector requires only user interaction, an attacker can host a malicious page that issues a forged request to a victim's authenticated qdbcrm session. Once visited, the browser submits the request with valid session credentials, executing the password change.

Root Cause

The root cause is missing CSRF protection on a state-changing HTTP endpoint, classified under CWE-352. The application trusts session cookies as the sole authentication mechanism without verifying request authenticity or user intent.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker delivers a crafted link or HTML page containing an auto-submitting form or image tag pointing at /user/edit?id=2 with attacker-controlled parameters. When the victim, authenticated to qdbcrm, loads the malicious content, the browser executes the request against the vulnerable endpoint. The server processes the credential change and returns a success response. See the public proof of concept for the request structure documented by the reporter.

Detection Methods for CVE-2024-0880

Indicators of Compromise

Unexpected POST or GET requests to /user/edit?id=<numeric_id> with Referer headers pointing to external or unknown domains
Password change events for accounts that did not initiate a reset workflow
Sudden account lockouts or failed logins following a successful user/edit response
HTTP requests to the edit endpoint missing typical browser navigation headers from the application UI

Detection Strategies

Inspect web server access logs for requests to /user/edit with off-origin Referer or Origin headers
Correlate password change events with prior user navigation; flag changes lacking a preceding visit to the account settings page
Deploy a Web Application Firewall (WAF) rule that requires a matching same-origin Origin header on POST requests to /user/edit

Monitoring Recommendations

Enable verbose audit logging on user account modification endpoints, capturing Referer, Origin, source IP, and User-Agent
Alert security operations when password resets occur outside business hours or from atypical client fingerprints
Forward CRM web logs to a centralized analytics platform for cross-account correlation of credential change patterns

How to Mitigate CVE-2024-0880

Immediate Actions Required

Restrict access to qdbcrm 1.1.0 instances behind a VPN or IP allowlist until a vendor patch is available
Force re-authentication for password change operations and require entry of the current password
Instruct users to log out of qdbcrm before browsing other sites in the same browser session
Review user accounts for unauthorized credential changes since deployment

Patch Information

No vendor patch is available. The vendor did not respond to the disclosure attempt documented in the VulDB entry. Organizations should evaluate migration to an alternative CRM platform or implement compensating controls described below.

Workarounds

Deploy a reverse proxy that injects and validates a CSRF token for all requests to /user/edit
Configure session cookies with SameSite=Strict and the Secure attribute at the proxy or application layer
Add a WAF rule to block requests to /user/edit whose Origin or Referer headers do not match the application hostname
Disable or restrict the affected endpoint to administrative users on a hardened management network

bash

# Example NGINX rule rejecting cross-origin requests to the vulnerable endpoint
location /user/edit {
    if ($http_origin !~* ^https://qdbcrm\.example\.com$) {
        return 403;
    }
    proxy_pass http://qdbcrm_backend;
}