CVE-2024-4589: DedeCMS 5.7 CSRF Vulnerability Disclosed

CVE-2024-4589 Overview

CVE-2024-4589 is a Cross-Site Request Forgery (CSRF) vulnerability in DedeCMS 5.7, a widely deployed PHP-based content management system. The flaw resides in the /src/dede/mytag_edit.php file within the administrative interface. An attacker can craft a malicious web page that, when visited by an authenticated administrator, triggers unauthorized state-changing actions in the CMS. The vulnerability is classified under [CWE-352]. The vendor was contacted before public disclosure but did not respond, leaving affected installations without an official patch.

Critical Impact
A remote attacker can trick an authenticated DedeCMS administrator into performing unintended actions through the mytag_edit.php endpoint, potentially modifying custom tags and site content without consent.

Affected Products

DedeCMS 5.7
DedeCMS administrative component /src/dede/mytag_edit.php
Deployments running the affected DedeCMS release without CSRF protections

Discovery Timeline

2024-05-07 - CVE-2024-4589 published to NVD with VulDB identifier VDB-263311
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-4589

Vulnerability Analysis

The vulnerability affects the mytag_edit.php script in the DedeCMS administrator directory. This endpoint processes tag editing requests but does not verify that incoming requests originate from an authenticated user session within the application. Because there is no anti-CSRF token, referer validation, or equivalent request-origin check, the browser of a signed-in administrator can be coerced into submitting attacker-controlled data. Exploitation requires user interaction: the administrator must visit or otherwise load attacker-controlled content while an active DedeCMS admin session exists in the same browser.

Root Cause

The root cause is missing CSRF protection [CWE-352] on a state-changing administrative endpoint. DedeCMS 5.7 does not bind a unique, unpredictable token to each administrative session and validate it on mytag_edit.php submissions. Consequently, the server treats any well-formed request accompanied by valid session cookies as legitimate, regardless of origin.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker hosts a malicious page containing a hidden form or scripted request targeting the vulnerable mytag_edit.php endpoint on a victim DedeCMS instance. When an authenticated administrator loads the page, the browser submits the forged request using existing session cookies. The DedeCMS backend then processes the request as if the administrator had initiated it, altering tag definitions or related configuration. Details are documented in the GitHub CMS Document write-up and the VulDB entry #263311.

Detection Methods for CVE-2024-4589

Indicators of Compromise

Unexpected modifications to DedeCMS custom tags or tag metadata not attributable to a known administrator action
HTTP POST requests to /src/dede/mytag_edit.php where the Referer or Origin header points to an external, untrusted domain
Administrator session activity correlated with visits to unfamiliar external URLs in web proxy or browser telemetry

Detection Strategies

Inspect web server access logs for POST requests to mytag_edit.php and correlate the Referer header against the DedeCMS site domain
Alert on administrative actions in DedeCMS that occur outside expected working hours or from browsers that also loaded unrelated third-party pages seconds earlier
Deploy a Web Application Firewall (WAF) rule that blocks state-changing requests to /src/dede/*.php when the Origin header is missing or does not match the site host

Monitoring Recommendations

Enable verbose audit logging in DedeCMS for all administrative endpoints, capturing user, action, timestamp, source IP, and headers
Forward web server and application logs to a centralized analytics platform for cross-source correlation of admin activity and browser behavior
Monitor for anomalous tag creation or edits and alert on any change to mytag_edit.php-backed data outside of scheduled maintenance windows

How to Mitigate CVE-2024-4589

Immediate Actions Required

Restrict access to the DedeCMS administrative directory to trusted IP ranges using web server access controls
Require administrators to use a dedicated browser or browser profile with no exposure to untrusted sites while managing DedeCMS
Terminate long-lived administrator sessions and enforce short session lifetimes to shrink the CSRF exploitation window

Patch Information

No vendor patch has been released. According to the disclosure, the DedeCMS maintainers were contacted before publication but did not respond. Administrators should track the VulDB advisory #263311 and the public write-up for updates, and evaluate migration to an actively maintained CMS if no fix becomes available.

Workarounds

Deploy a reverse proxy or WAF rule that rejects requests to /src/dede/mytag_edit.php lacking a same-origin Referer or Origin header
Add a custom CSRF token check in front of mytag_edit.php via a server-side include or middleware, and reject submissions without a valid token
Rename or relocate the DedeCMS administrative directory from the default /src/dede/ path to reduce automated targeting

bash

# Example nginx configuration to block cross-origin POSTs to the vulnerable endpoint
location = /src/dede/mytag_edit.php {
    if ($request_method = POST) {
        set $csrf_block "1";
    }
    if ($http_origin ~* "^https?://your-dedecms-domain\.example$") {
        set $csrf_block "0";
    }
    if ($csrf_block = "1") {
        return 403;
    }
    include fastcgi_params;
    fastcgi_pass unix:/var/run/php-fpm.sock;
}