CVE-2024-2277: Bdtask G-prescription CSRF Vulnerability

CVE-2024-2277 Overview

CVE-2024-2277 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in Bdtask G-Prescription Gynaecology & OBS Consultation Software version 1.0. The flaw affects the /Setting/change_password_save endpoint within the Password Reset Handler component. An attacker can craft a malicious web page that triggers an unauthorized password change when an authenticated victim visits it. The exploit has been publicly disclosed under VulDB identifier VDB-256046. The vendor did not respond to disclosure attempts, and no official patch is available.

Critical Impact
Remote attackers can hijack authenticated user sessions to reset passwords without consent, enabling account takeover of clinicians and administrators of the medical consultation software.

Affected Products

Bdtask G-Prescription Gynaecology & OBS Consultation Software 1.0
Component: Password Reset Handler (/Setting/change_password_save)
Vendor: Bdtask (unresponsive to disclosure)

Discovery Timeline

2024-03-08 - CVE-2024-2277 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-2277

Vulnerability Analysis

The vulnerability resides in the password change workflow of G-Prescription 1.0. The /Setting/change_password_save endpoint accepts state-changing POST requests without validating a per-session anti-CSRF token. Because the application relies solely on session cookies for authentication, any request originating from an authenticated browser is accepted as legitimate.

An attacker can host a malicious page that submits a forged form to the vulnerable endpoint. When a logged-in user visits the attacker-controlled page, the browser automatically attaches session cookies and submits the forged password change request. User interaction is required to trigger the request, but no additional privileges on the target application are needed.

The impact is limited to integrity of the user account state. However, successful exploitation grants the attacker the new credentials, enabling full account takeover of clinicians, support staff, or administrators who interact with sensitive patient prescription data.

Root Cause

The root cause is the absence of CSRF protections on a sensitive state-changing endpoint. The application does not implement synchronizer tokens, double-submit cookies, SameSite cookie restrictions, or an Origin/Referer header check on /Setting/change_password_save. This aligns with the standard pattern described in CWE-352: Cross-Site Request Forgery.

Attack Vector

Exploitation requires an authenticated victim to visit an attacker-controlled page or click a crafted link. The attacker hosts an HTML form targeting /Setting/change_password_save with the attacker's chosen password values. On page load or submission, the browser issues the request with the victim's session cookies attached. The server processes the password change as if it came from the legitimate user. Technical disclosure details are available in the VulDB entry 256046.

Detection Methods for CVE-2024-2277

Indicators of Compromise

Password change events in application logs for /Setting/change_password_save without a preceding user-initiated navigation to the password settings page.
HTTP requests to the password save endpoint containing a cross-origin Referer or Origin header pointing to an untrusted domain.
Account lockouts or user-reported inability to authenticate shortly after browsing third-party sites or opening unsolicited email links.

Detection Strategies

Deploy a web application firewall (WAF) rule that blocks POST requests to /Setting/change_password_save lacking a valid same-origin Referer header.
Correlate authentication log anomalies, such as rapid password changes followed by logins from new IP addresses or user agents.
Review application access logs for state-changing requests with missing or mismatched CSRF token parameters.

Monitoring Recommendations

Alert on any password modification activity occurring outside normal business hours or from atypical geolocations for the affected user.
Monitor outbound email gateways for phishing lures referencing the G-Prescription application domain.
Track browser session telemetry for unusual cross-site form submissions targeting the application host.

How to Mitigate CVE-2024-2277

Immediate Actions Required

Restrict access to the G-Prescription web interface to trusted internal networks or require VPN access until a vendor patch is available.
Instruct users to log out of the application before browsing untrusted sites and to use dedicated browser profiles for the medical application.
Enforce short session timeouts to reduce the window during which a CSRF attack can succeed.

Patch Information

No vendor patch is currently available. According to the disclosure, Bdtask was contacted but did not respond. Organizations should contact the vendor directly for remediation status or evaluate migration to an alternative platform. Monitor the VulDB CTI entry for updates.

Workarounds

Deploy a reverse proxy or WAF rule that rejects POST requests to /Setting/change_password_save when the Origin or Referer header does not match the application's domain.
Configure session cookies with the SameSite=Strict attribute at the proxy layer to prevent cross-site cookie attachment.
Require re-authentication or an out-of-band confirmation step before any password change takes effect.

bash

# Example NGINX reverse proxy rule enforcing same-origin password changes
location = /Setting/change_password_save {
    if ($request_method = POST) {
        set $csrf_ok 0;
        if ($http_origin ~* "^https://gprescription\.internal\.example$") { set $csrf_ok 1; }
        if ($http_referer ~* "^https://gprescription\.internal\.example/") { set $csrf_ok 1; }
        if ($csrf_ok = 0) { return 403; }
    }
    proxy_pass http://gprescription_backend;
}