CVE-2024-12901: Qianfox Foxcms Authorization Bypass Vulnerability

CVE-2024-12901 Overview

CVE-2024-12901 is an improper authorization vulnerability in FoxCMS versions up to 1.2. The flaw resides in the /app/api/controller/Site.php file, where manipulation of the password argument enables unauthorized access. Attackers can exploit the issue remotely over the network without authentication or user interaction. The vulnerability is classified under [CWE-266] Incorrect Privilege Assignment. Public disclosure of the exploit technique has occurred, increasing the likelihood of opportunistic attacks against exposed FoxCMS deployments.

Critical Impact
Remote attackers can bypass authorization checks in the FoxCMS API endpoint by manipulating the password parameter, leading to limited integrity compromise of affected sites.

Affected Products

Qianfox FoxCMS versions up to and including 1.2
Component: API Endpoint (/app/api/controller/Site.php)
Deployments exposing the Site controller to untrusted networks

Discovery Timeline

2024-12-23 - CVE-2024-12901 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-12901

Vulnerability Analysis

The vulnerability affects the Site.php controller within the FoxCMS API layer. FoxCMS is a content management system developed by Qianfox and used for building and managing websites. The controller handles site-related API requests and processes a password argument as part of its input.

Improper authorization occurs when the endpoint fails to correctly validate whether the requesting user has the privileges to perform the requested operation. Attackers manipulate the password argument to influence the authorization decision, obtaining access to functionality that should be restricted.

The attack requires no authentication and no user interaction. Because the endpoint is reachable over the network, exploitation is possible directly against internet-exposed installations. Public disclosure of the technique lowers the barrier to opportunistic scanning and abuse.

Root Cause

The root cause is incorrect privilege assignment [CWE-266] in the Site.php controller. The controller relies on client-supplied input, specifically the password argument, as part of its authorization logic without enforcing an independent server-side privilege check. Manipulated values allow requests to pass authorization gates that should reject them.

Attack Vector

The attack vector is network-based. An attacker crafts an HTTP request to the FoxCMS API endpoint backed by /app/api/controller/Site.php and supplies a manipulated password parameter. The server accepts the request and grants access without enforcing the intended authorization checks. Refer to the Zhao J. Sharing Note and VulDB entry #289171 for additional technical context.

Detection Methods for CVE-2024-12901

Indicators of Compromise

Unauthenticated HTTP requests to /app/api/controller/Site.php or the corresponding API route from unusual source IP addresses
Requests containing unexpected or malformed values in the password parameter
Successful API responses returned to clients that never completed an authentication flow

Detection Strategies

Deploy web application firewall rules that inspect requests targeting the FoxCMS Site controller and flag anomalous password values
Correlate authentication logs with API access logs to identify requests granted access without a prior successful login
Baseline normal API traffic to the FoxCMS installation and alert on volume or source deviations against the affected endpoint

Monitoring Recommendations

Enable verbose logging on the FoxCMS application server for all requests to /app/api/* routes
Forward web server and application logs to a centralized analytics platform for retention and correlation
Monitor for lateral changes to site content, configuration, or user records that could indicate post-exploitation activity

How to Mitigate CVE-2024-12901

Immediate Actions Required

Inventory all FoxCMS deployments and identify instances running version 1.2 or earlier
Restrict network access to the FoxCMS administrative and API endpoints using firewall rules or reverse proxy allow-lists
Review recent access logs for the Site.php controller to identify suspicious activity
Rotate credentials and API tokens associated with affected FoxCMS installations if compromise is suspected

Patch Information

No vendor advisory or patched release is referenced in the available CVE data. Operators should monitor the Qianfox FoxCMS project channels and the vendor's official distribution site for a fixed version. Until a patch is available, apply the workarounds below.

Workarounds

Place the FoxCMS API behind an authenticating reverse proxy that enforces access control before requests reach Site.php
Block or rate-limit external access to /app/api/controller/Site.php at the web server or WAF layer
Implement server-side input validation to reject requests with unexpected password parameter structures
Consider taking the affected instance offline if it handles sensitive content and cannot be adequately isolated