CVE-2024-3145: DedeCMS 5.7 CSRF Vulnerability

CVE-2024-3145 Overview

CVE-2024-3145 is a cross-site request forgery (CSRF) vulnerability [CWE-352] in DedeCMS 5.7, a widely deployed Chinese content management system. The flaw resides in the /src/dede/makehtml_js_action.php file and allows attackers to trick authenticated administrators into executing unintended actions. Exploitation requires user interaction, typically clicking a crafted link or visiting a malicious page while logged in. The vulnerability was publicly disclosed through VulDB as identifier VDB-258920. According to the CVE record, the vendor was contacted but did not respond to the disclosure, meaning no official patch is available.

Critical Impact
Attackers can hijack authenticated administrator sessions to trigger unauthorized backend actions in DedeCMS 5.7, resulting in limited integrity impact on affected installations.

Affected Products

DedeCMS 5.7
Component: /src/dede/makehtml_js_action.php
Vendor: dedecms (unresponsive to disclosure)

Discovery Timeline

2024-04-02 - CVE-2024-3145 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-3145

Vulnerability Analysis

The vulnerability is a classic CSRF issue in the DedeCMS administrative backend. The makehtml_js_action.php script processes state-changing requests without validating that the request originated from a legitimate, user-initiated action within the application. Because the script relies solely on session cookies for authentication, any request carrying a valid admin session cookie is processed as authoritative.

An attacker who lures an authenticated administrator to a controlled page can issue forged HTTP requests to the vulnerable endpoint. The browser automatically attaches session cookies, and the backend executes the requested action. The confidentiality impact is none, while integrity is affected because backend state can be modified. Availability remains unaffected.

Root Cause

The root cause is the absence of anti-CSRF controls on the makehtml_js_action.php endpoint. The script does not require a per-session, unpredictable token bound to the request. It also does not enforce SameSite cookie policy or verify the Origin and Referer headers before executing sensitive operations.

Attack Vector

Exploitation occurs over the network and requires user interaction. An attacker crafts an HTML page containing an auto-submitting form or an image tag targeting the vulnerable URL. When an authenticated DedeCMS administrator visits the page, the browser transmits the forged request along with the valid session cookie, and the backend action is executed under the administrator's identity.

No verified proof-of-concept code is published in the referenced sources. The GitHub CMS Documentation referenced in the advisory describes the affected functionality in further detail.

Detection Methods for CVE-2024-3145

Indicators of Compromise

Unexpected HTTP POST or GET requests to /src/dede/makehtml_js_action.php originating from external Referer headers.
Administrator-initiated backend actions occurring at times inconsistent with normal operator activity.
Web server access logs showing repeated requests to the vulnerable endpoint from a single external referrer domain.

Detection Strategies

Deploy web application firewall (WAF) rules that flag requests to makehtml_js_action.php lacking a matching same-origin Referer or Origin header.
Correlate administrator session activity with source IP geolocation and browser fingerprint changes to surface session-riding behavior.
Review PHP application logs for backend operations triggered without a corresponding legitimate admin console navigation event.

Monitoring Recommendations

Enable verbose logging on the DedeCMS /dede/ administrative directory and forward logs to a centralized SIEM.
Alert on any HTTP requests to the vulnerable endpoint carrying a cross-origin Referer value.
Track browser sessions issuing requests to makehtml_js_action.php immediately after visiting untrusted external domains.

How to Mitigate CVE-2024-3145

Immediate Actions Required

Restrict access to the /src/dede/ administrative directory using web server IP allow-listing until a vendor patch is available.
Require administrators to log out of DedeCMS before browsing untrusted sites and enforce short session timeouts.
Configure session cookies with SameSite=Strict and HttpOnly attributes to block cross-site cookie transmission.

Patch Information

No vendor patch is currently available. The CVE record states the DedeCMS maintainers did not respond to the disclosure. Administrators should monitor the VulDB entry #258920 and the VulDB CTI entry for updates. In the absence of an official fix, organizations should apply compensating controls or migrate to a maintained CMS platform.

Workarounds

Implement a reverse proxy or WAF rule requiring a valid same-origin Referer header for all requests to /src/dede/makehtml_js_action.php.
Add a custom anti-CSRF token check by wrapping the vulnerable endpoint with a server-side middleware that validates a token on every state-changing request.
Isolate the DedeCMS administrative interface on a separate hostname or VPN-only network segment to reduce browser exposure to attacker-controlled origins.

bash

# Example nginx configuration to enforce same-origin Referer on the vulnerable endpoint
location = /src/dede/makehtml_js_action.php {
    if ($http_referer !~* "^https?://your-dedecms-domain\.example/") {
        return 403;
    }
    include fastcgi_params;
    fastcgi_pass unix:/var/run/php/php-fpm.sock;
}