CVE-2024-11142: Proticaret E-Commerce CSRF Vulnerability

CVE-2024-11142 Overview

CVE-2024-11142 is a Cross-Site Request Forgery (CSRF) vulnerability affecting Gosoft Software Proticaret E-Commerce versions prior to v6.0. The flaw maps to [CWE-352] and allows attackers to trick authenticated users into submitting unintended state-changing requests to the application. Successful exploitation can compromise confidentiality, integrity, and availability of the targeted e-commerce instance. According to the vendor, the remediation process is still ongoing for v4.05.

Critical Impact
Attackers can leverage authenticated victim sessions to perform arbitrary state-changing operations in the Proticaret storefront, including account, order, and administrative actions.

Affected Products

Gosoft Software Proticaret E-Commerce versions before v6.0
Proticaret v4.05 (fix still in progress per vendor)
All deployments exposing the Proticaret web interface to untrusted networks

Discovery Timeline

2025-05-02 - CVE-2024-11142 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-11142

Vulnerability Analysis

The vulnerability stems from missing anti-CSRF protections on state-changing endpoints in Proticaret E-Commerce. The application does not validate that authenticated requests originate from its own user interface. Attackers can craft a malicious page or email that triggers requests using the victim's session cookies. Because the platform handles customer accounts, orders, and administrative configuration, the impact extends beyond simple form submissions.

Exploitation requires user interaction, such as clicking a crafted link or visiting an attacker-controlled page while logged in. Once triggered, the forged request inherits the victim's privileges, allowing modification of account data, order state, or administrative settings depending on the target user's role.

Root Cause

The root cause is the absence of synchronizer tokens, double-submit cookies, or SameSite cookie enforcement on sensitive endpoints. Proticaret relies solely on session cookies for authentication context without binding requests to a per-session secret. This design flaw aligns with [CWE-352] (Cross-Site Request Forgery).

Attack Vector

The attack vector is network-based with low complexity and no required privileges, but user interaction is needed. An attacker hosts a crafted HTML page containing auto-submitting forms or image tags pointing at sensitive Proticaret endpoints. When an authenticated administrator or customer visits the page, the browser submits the request with valid session cookies, and the server processes it as legitimate.

No verified public proof-of-concept code is available. Refer to the Siber Güvenlik Advisory #TR-25-0098 and USOM Notification #TR-25-0098 for additional technical context.

Detection Methods for CVE-2024-11142

Indicators of Compromise

Unexpected administrative changes (user role modifications, price changes, order status updates) without corresponding admin login activity
HTTP requests to sensitive Proticaret endpoints with Referer or Origin headers pointing to external untrusted domains
Spike in POST requests from a single authenticated session originating from unusual referrers

Detection Strategies

Inspect web server access logs for state-changing POST requests where the Referer header does not match the Proticaret domain
Correlate authenticated session activity with browser navigation history to identify out-of-band actions
Deploy a Web Application Firewall (WAF) rule that flags requests missing or containing mismatched Origin headers on sensitive routes

Monitoring Recommendations

Forward Proticaret application and web server logs to a centralized SIEM for behavioral analysis
Alert on administrative configuration changes occurring outside business hours or from atypical client fingerprints
Monitor for phishing campaigns referencing the Proticaret storefront that could be used to deliver CSRF payloads

How to Mitigate CVE-2024-11142

Immediate Actions Required

Upgrade Proticaret E-Commerce to version 6.0 or later, which contains the vendor fix
Restrict administrative panel access to trusted IP ranges or VPN-only networks until patching is complete
Force re-authentication and rotate session secrets for all administrative accounts

Patch Information

Gosoft Software has remediated the issue in Proticaret E-Commerce v6.0. The vendor has indicated that the fix for the v4.05 branch is still in progress, so operators on legacy versions should plan a migration to v6.0. Consult the Siber Güvenlik Advisory #TR-25-0098 for vendor coordination details.

Workarounds

Configure session cookies with SameSite=Strict or SameSite=Lax attributes at the reverse proxy layer
Deploy WAF rules that require a valid Origin or Referer header matching the application domain on POST, PUT, and DELETE requests
Educate administrators to log out of the Proticaret admin panel when not in use and avoid browsing untrusted sites during active sessions

bash

# Example nginx configuration to enforce SameSite cookies and Origin validation
proxy_cookie_path / "/; SameSite=Strict; Secure; HttpOnly";

map $http_origin $allowed_origin {
    default 0;
    "https://store.example.com" 1;
}

server {
    location ~* /admin/ {
        if ($request_method ~ ^(POST|PUT|DELETE)$) {
            if ($allowed_origin = 0) { return 403; }
        }
        proxy_pass http://proticaret_backend;
    }
}