CVE-2024-4591: DedeCMS 5.7 CSRF Vulnerability

CVE-2024-4591 Overview

CVE-2024-4591 is a cross-site request forgery (CSRF) vulnerability [CWE-352] in DedeCMS 5.7. The flaw resides in the /src/dede/sys_group_add.php administrative endpoint. An attacker can craft a malicious request that, when triggered by an authenticated administrator, performs unintended state-changing actions on the content management system. The vulnerability is remotely exploitable over the network and requires user interaction. The vendor was contacted about this disclosure but did not respond, and the exploit details have been publicly released through VulDB entry VDB-263313.

Critical Impact
An attacker can trick an authenticated DedeCMS administrator into submitting forged requests that create or modify user groups, leading to integrity impact on the CMS configuration.

Affected Products

DedeCMS 5.7
/src/dede/sys_group_add.php administrative script
DedeCMS deployments exposing the admin interface to browsers with active administrator sessions

Discovery Timeline

2024-05-07 - CVE-2024-4591 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-4591

Vulnerability Analysis

The vulnerability affects the sys_group_add.php script in the DedeCMS administrative directory. This script handles the creation of system user groups but does not validate that incoming requests originate from the legitimate admin interface. Without an anti-CSRF token or origin check, the browser of any authenticated administrator can be coerced into issuing arbitrary requests to this endpoint. An attacker hosts a crafted page or embeds a hidden form in an external site. When the administrator visits the attacker-controlled page while logged in, the browser automatically attaches session cookies and submits the forged request. See the GitHub CMS Resource for the publicly disclosed proof-of-concept.

Root Cause

The root cause is the absence of a synchronizer token pattern or equivalent CSRF protection on the sys_group_add.php handler. The endpoint accepts state-changing POST parameters based solely on session cookies. It does not verify a per-session, per-request token, and it does not enforce Origin or Referer header validation against an allowlist.

Attack Vector

Exploitation requires an authenticated DedeCMS administrator to interact with attacker-controlled content, typically by visiting a malicious URL or opening a crafted HTML email. The attacker embeds an auto-submitting HTML form or image tag pointing at the vulnerable endpoint. On submission, the browser attaches the administrator's active session cookie, and DedeCMS processes the request as legitimate. The impact is limited to integrity (CVSS I:L), with no direct confidentiality or availability impact, and no read-back of results to the attacker.

Detection Methods for CVE-2024-4591

Indicators of Compromise

Unexpected entries in the DedeCMS sys_admin_group table or newly created administrative groups without a corresponding change ticket.
Web server access logs showing POST requests to /src/dede/sys_group_add.php with Referer headers pointing to external domains.
Administrator session activity originating from browser tabs immediately following visits to untrusted third-party sites.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect requests to /dede/sys_group_add.php and block those lacking a valid Referer or Origin matching the CMS host.
Correlate outbound HTTP referrals from administrator workstations with subsequent state changes in the DedeCMS admin panel.
Audit application logs for group-creation events and compare against authorized change records.

Monitoring Recommendations

Enable verbose logging on the /src/dede/ administrative directory to capture request headers, body parameters, and source IPs.
Alert on any HTTP POST to admin endpoints where the Referer header is absent or does not match the CMS domain.
Monitor for anomalous administrator session activity outside of business hours or from unfamiliar user agents.

How to Mitigate CVE-2024-4591

Immediate Actions Required

Restrict access to the /src/dede/ administrative directory using IP allowlisting or a VPN.
Enforce short session lifetimes for administrator accounts and require re-authentication for sensitive actions such as group creation.
Instruct administrators to log out of DedeCMS before browsing unrelated sites and to use a dedicated browser profile for CMS administration.

Patch Information

The vendor did not respond to disclosure attempts, and no official patch has been published for CVE-2024-4591 at the time of NVD publication. Refer to VulDB #263313 for the latest advisory status. Organizations running DedeCMS 5.7 should apply compensating controls and evaluate migrating to a maintained content management platform.

Workarounds

Add a WAF rule requiring the Origin or Referer header on POST requests to sys_group_add.php to match the CMS hostname.
Implement a reverse proxy that injects and validates a custom anti-CSRF header for all requests to /src/dede/ endpoints.
Remove or rename the sys_group_add.php script if group management is not required, and manage groups directly at the database layer under change control.

bash

# Example nginx configuration enforcing same-origin on the vulnerable endpoint
location ~* /src/dede/sys_group_add\.php$ {
    if ($http_referer !~* "^https?://cms\.example\.com/") {
        return 403;
    }
    if ($request_method = POST) {
        if ($http_origin !~* "^https?://cms\.example\.com$") {
            return 403;
        }
    }
    include fastcgi_params;
    fastcgi_pass unix:/run/php/php-fpm.sock;
}