CVE-2024-4590 Overview
CVE-2024-4590 is a cross-site request forgery (CSRF) vulnerability in DedeCMS 5.7. The flaw resides in the /src/dede/sys_info.php file and affects unspecified functionality within the system information management component [CWE-352]. An attacker can craft a malicious request that, when triggered by an authenticated administrator, modifies system configuration on the target application. The exploit has been publicly disclosed. The vendor was contacted before disclosure but did not respond, and no official patch is referenced in the advisory.
Critical Impact
Remote attackers can trick authenticated DedeCMS administrators into submitting unauthorized configuration changes through crafted web requests, altering integrity of system information settings.
Affected Products
- DedeCMS 5.7
- Component: /src/dede/sys_info.php
- Vendor: dedecms (unresponsive to disclosure)
Discovery Timeline
- 2024-05-07 - CVE-2024-4590 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-4590
Vulnerability Analysis
The vulnerability affects the DedeCMS administrative backend, specifically the sys_info.php script that handles system information settings. The application does not validate the origin of state-changing HTTP requests, so it accepts any request that carries valid session cookies. An attacker hosting malicious content can cause an authenticated administrator's browser to submit unintended requests to the DedeCMS instance.
The exploitation flow requires user interaction. The victim must be authenticated to the DedeCMS admin panel and must visit an attacker-controlled page or click a crafted link. When the browser submits the forged request, the server processes it as a legitimate action from the administrator.
Root Cause
The root cause is missing anti-CSRF protection on state-changing requests to /src/dede/sys_info.php. The endpoint lacks synchronizer tokens, origin/referer header validation, or SameSite cookie enforcement. Without these controls, the server cannot distinguish between requests initiated by the authenticated user and those triggered from a third-party site.
Attack Vector
Exploitation is network-based and requires low attack complexity. The attacker prepares a webpage containing an auto-submitting form or image tag pointing at the vulnerable endpoint. Any DedeCMS administrator with an active session who visits the attacker's page will unknowingly execute the action. No credentials are required from the attacker; the attack leverages the victim's existing authentication state.
Refer to the public disclosure on GitHub and VulDB Entry #263312 for a reproduction of the request structure.
Detection Methods for CVE-2024-4590
Indicators of Compromise
- Unexpected changes to DedeCMS system information settings recorded in admin logs.
- HTTP POST requests to /src/dede/sys_info.php with Referer or Origin headers pointing to external, untrusted domains.
- Administrator session activity originating from unusual pages immediately preceding configuration changes.
Detection Strategies
- Review web server access logs for requests to /src/dede/sys_info.php and correlate with the referring page to identify off-site initiators.
- Deploy a web application firewall (WAF) rule that flags state-changing POSTs missing an anti-CSRF token or with mismatched Origin headers.
- Enable audit logging within DedeCMS to record configuration modifications and the source IP of the initiating session.
Monitoring Recommendations
- Alert on administrator configuration changes made outside of normal maintenance windows.
- Monitor for phishing lures or emails delivered to DedeCMS administrators that link to external content while an admin session is active.
- Track browser-based access patterns to the /dede/ administrative directory for cross-origin request anomalies.
How to Mitigate CVE-2024-4590
Immediate Actions Required
- Restrict access to the /dede/ administrative directory to trusted IP addresses through web server or firewall rules.
- Require administrators to log out of the DedeCMS backend when not actively managing the site to shrink the exploitable session window.
- Configure session cookies with the SameSite=Strict attribute and the Secure flag to block cross-site request delivery.
Patch Information
No vendor patch is referenced in the NVD advisory. The vendor did not respond to the disclosure. Organizations running DedeCMS 5.7 should monitor the DedeCMS project channels for future updates and evaluate migration to an actively maintained content management platform.
Workarounds
- Deploy a reverse proxy or WAF rule that rejects requests to /src/dede/sys_info.php when the Origin or Referer header does not match the site domain.
- Enforce multi-factor authentication and short session timeouts for administrator accounts to reduce the impact of forged requests.
- Isolate administrator browsing sessions from general web browsing by using dedicated browser profiles or workstations for CMS management.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
