CVE-2024-3143: DedeCMS Cross-Site Request Forgery Vulnerability

CVE-2024-3143 Overview

CVE-2024-3143 is a Cross-Site Request Forgery (CSRF) vulnerability in DedeCMS 5.7, a widely deployed Chinese content management system. The flaw resides in an unspecified function within the /src/dede/member_rank.php file, which handles member rank administration. Attackers can craft a malicious web page or link that, when visited by an authenticated administrator, triggers unintended state-changing actions in the DedeCMS backend. The exploit has been publicly disclosed and is trackable as VulDB entry VDB-258918. The vendor did not respond to disclosure attempts, leaving affected installations without an official patch.

Critical Impact
Remote attackers can coerce authenticated DedeCMS administrators into executing unauthorized member rank modifications via a crafted request, with no privileges required on the attacker side.

Affected Products

DedeCMS 5.7
/src/dede/member_rank.php administrative endpoint
Deployments where administrators access the CMS backend from browsers with active third-party sessions

Discovery Timeline

2024-04-02 - CVE-2024-3143 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-3143

Vulnerability Analysis

The vulnerability is a Cross-Site Request Forgery weakness classified under [CWE-352]. DedeCMS 5.7 fails to validate the origin and intent of state-changing requests directed at /src/dede/member_rank.php. When an authenticated administrator visits an attacker-controlled page, the browser automatically attaches the administrator's session cookies to any request targeting the CMS. The application accepts these forged requests as legitimate administrative actions. Because the endpoint governs member ranks, forged submissions can alter membership tiers or associated permissions, undermining access control integrity within the CMS.

Root Cause

The root cause is the absence of anti-CSRF controls on the member_rank.php endpoint. DedeCMS does not issue or validate per-session synchronizer tokens, does not verify the Origin or Referer headers, and does not require SameSite cookie enforcement for administrative sessions. Any state-changing operation exposed through this handler is therefore reachable by cross-origin request forgery.

Attack Vector

Exploitation requires an authenticated administrator to interact with attacker-supplied content, satisfying the user-interaction requirement in the attack vector. The attacker hosts a page containing an auto-submitting HTML form or an <img> tag pointing to the vulnerable endpoint with attacker-chosen parameters. When the administrator loads the page while logged into DedeCMS, the browser issues the forged request under the administrator's session. Additional technical details are documented in the VulDB entry #258918 and the proof-of-concept write-up.

Detection Methods for CVE-2024-3143

Indicators of Compromise

Unexpected modifications to member rank records in the DedeCMS database, particularly rows written outside normal administrative working hours.
HTTP POST requests to /src/dede/member_rank.php where the Referer header points to an external domain rather than the DedeCMS admin console.
Administrative session activity originating from browsers immediately after visits to untrusted third-party sites.

Detection Strategies

Deploy web server or web application firewall rules that log and alert on requests to /src/dede/member_rank.php lacking a same-origin Referer or Origin header.
Enable database audit logging on member rank tables to correlate schema changes with authenticated administrator sessions.
Baseline normal administrator request patterns and flag anomalous cross-origin request bursts targeting the /dede/ administrative path.

Monitoring Recommendations

Forward DedeCMS access logs and administrative audit trails into a centralized SIEM for cross-referencing with browsing telemetry.
Monitor outbound administrator browsing activity for unexpected visits to newly registered or low-reputation domains that precede backend changes.
Alert on repeated 302/200 responses from member_rank.php that lack a preceding admin console navigation sequence.

How to Mitigate CVE-2024-3143

Immediate Actions Required

Restrict access to the /src/dede/ administrative directory using IP allowlisting at the web server or reverse proxy layer.
Require administrators to use a dedicated browser profile or isolated session for DedeCMS management, eliminating cross-site cookie exposure.
Set the administrative session cookie to SameSite=Strict and Secure to block cross-origin request delivery of session credentials.

Patch Information

No vendor patch is available. The VulDB advisory notes that the vendor did not respond to the disclosure. Administrators should treat DedeCMS 5.7 deployments as unpatched and apply compensating controls until an upstream fix or community patch is released. Consider migrating to an actively maintained CMS if long-term support is required.

Workarounds

Deploy a web application firewall rule that rejects requests to /src/dede/member_rank.php unless the Origin or Referer header matches the trusted admin hostname.
Enforce short administrator session lifetimes and require re-authentication before executing sensitive member rank operations.
Add a reverse proxy layer that injects and validates a synchronizer token on all POST requests to /src/dede/ endpoints.

bash

# Nginx snippet: reject cross-origin POSTs to the vulnerable endpoint
location = /src/dede/member_rank.php {
    if ($request_method = POST) {
        set $csrf_ok 0;
        if ($http_referer ~* "^https?://admin\.example\.com/") { set $csrf_ok 1; }
        if ($csrf_ok = 0) { return 403; }
    }
    proxy_pass http://dedecms_backend;
}