CVE-2024-24524: Flusity CMS CSRF Vulnerability

CVE-2024-24524 Overview

CVE-2024-24524 is a Cross-Site Request Forgery (CSRF) vulnerability affecting flusity-CMS version 2.33. The flaw resides in the add_menu.php component, which fails to validate the origin and authenticity of incoming state-changing requests. Remote attackers can trick an authenticated administrator into submitting a forged request that adds menu entries or executes arbitrary code on the underlying server. The vulnerability is tracked as CWE-352: Cross-Site Request Forgery.

Critical Impact
Successful exploitation allows remote attackers to execute arbitrary code on flusity-CMS v2.33 instances by leveraging an authenticated administrator's browser session.

Affected Products

flusity-CMS version 2.33
add_menu.php component within flusity-CMS
Deployments exposing the administrative interface to authenticated browser sessions

Discovery Timeline

2024-02-02 - CVE-2024-24524 published to the National Vulnerability Database
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-24524

Vulnerability Analysis

The vulnerability stems from missing anti-CSRF protections in the add_menu.php endpoint of flusity-CMS v2.33. The endpoint accepts authenticated POST requests to create menu entries but does not verify a per-session CSRF token, Origin header, or Referer header. An attacker can host a malicious page that auto-submits a crafted form to a victim administrator's flusity-CMS instance. When the administrator visits the attacker-controlled page while logged in, the browser attaches valid session cookies and the request executes with full administrative privileges.

Because flusity-CMS menu creation accepts attacker-controlled content, this CSRF can be chained into arbitrary code execution. Injected payloads stored through add_menu.php are subsequently rendered or processed by the CMS, enabling the attacker to reach a code execution sink without ever holding valid credentials.

Root Cause

The add_menu.php handler omits server-side validation of a synchronizer token tied to the administrator's session. It also fails to enforce SameSite cookie policies or Origin checks. This design issue means any cross-origin request carrying the admin's session cookie is treated as legitimate.

Attack Vector

Exploitation occurs over the network and requires user interaction from an authenticated administrator. The attacker delivers a phishing link, malicious advertisement, or watering-hole page containing an auto-submitting form targeting /add_menu.php on the victim's flusity-CMS host. No credentials are required by the attacker. Proof-of-concept details are published in the GitHub PoC Repository.

No synthetic exploit code is included here. Refer to the linked PoC for the documented request structure used to demonstrate the issue.

Detection Methods for CVE-2024-24524

Indicators of Compromise

Unexpected POST requests to add_menu.php originating from external Referer or Origin headers
Newly created menu entries that contain script tags, PHP payloads, or unusual character sequences
Administrator session activity correlated with inbound traffic from unrelated third-party domains
Web shells or unfamiliar files written to the flusity-CMS webroot following menu modifications

Detection Strategies

Inspect web server access logs for POST requests to add_menu.php where the Referer header is missing or points outside the application domain
Alert on menu creation events occurring outside normal administrator workflows or business hours
Deploy a web application firewall rule that blocks state-changing requests to flusity admin endpoints lacking a valid CSRF token

Monitoring Recommendations

Forward flusity-CMS access and audit logs to a centralized SIEM for correlation with browser session telemetry
Monitor file integrity on the CMS webroot to detect unauthorized file writes following menu changes
Track administrator session duration and concurrent activity to surface session-riding patterns

How to Mitigate CVE-2024-24524

Immediate Actions Required

Restrict access to the flusity-CMS administrative interface using IP allow-listing or VPN-only access
Require administrators to log out of the CMS when not actively performing maintenance
Audit existing menu entries in flusity-CMS v2.33 for unexpected or attacker-controlled content
Block external Referer and Origin headers from reaching admin endpoints at the reverse proxy layer

Patch Information

No vendor advisory or fixed version was published in the NVD record at the time of writing. Operators running flusity-CMS v2.33 should track the flusity-CMS project repository for upstream fixes and apply them as soon as they become available. Until a patch is released, treat the add_menu.php endpoint as exposed and apply the workarounds below.

Workarounds

Place flusity-CMS administrative paths behind an authenticating reverse proxy that injects and validates a CSRF token
Set session cookies to SameSite=Strict to prevent cross-site cookie transmission on state-changing requests
Deploy a WAF rule that rejects POST requests to add_menu.php lacking a matching Origin and Referer header
Educate administrators to use a dedicated browser profile for CMS administration and avoid browsing untrusted sites while authenticated

bash

# Example nginx configuration restricting admin endpoints by source IP
location ~* /(add_menu|admin)\.php$ {
    allow 10.0.0.0/8;
    deny all;
    add_header Set-Cookie "Path=/; HttpOnly; Secure; SameSite=Strict";
}