CVE-2024-4594: Dedecms 5.7 CSRF Vulnerability

CVE-2024-4594 Overview

CVE-2024-4594 is a Cross-Site Request Forgery (CSRF) vulnerability in DedeCMS 5.7, a widely used Chinese content management system. The flaw resides in an unspecified function within the /src/dede/sys_safe.php administrative script. Attackers can craft malicious requests that trigger unauthorized state changes when an authenticated administrator visits an attacker-controlled page. The weakness is tracked under CWE-352: Cross-Site Request Forgery and was publicly disclosed with identifier VDB-263316. According to the advisory, the vendor was contacted prior to disclosure but did not respond.

Critical Impact
Remote attackers can forge administrative requests against the DedeCMS security settings page, altering configuration without the administrator's knowledge or consent.

Affected Products

DedeCMS 5.7
Component: /src/dede/sys_safe.php
Deployments exposing the DedeCMS admin interface to authenticated users browsing untrusted content

Discovery Timeline

2024-05-07 - CVE-2024-4594 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-4594

Vulnerability Analysis

The vulnerability affects the DedeCMS administrative module responsible for system safety configuration. The /src/dede/sys_safe.php endpoint processes state-changing requests without verifying that the request originated from the administrator's own session. An attacker can embed a crafted HTML form or image tag on an external site. When an authenticated DedeCMS administrator loads that content, the browser automatically attaches the valid session cookies and submits the forged request.

Successful exploitation requires user interaction, specifically that an administrator is authenticated and visits attacker-controlled content. Impact is limited to integrity of configuration data; the flaw does not directly disclose information or crash the service. However, modifying security settings can weaken downstream protections and enable follow-on attacks.

Root Cause

The root cause is the absence of anti-CSRF controls on the sys_safe.php handler. DedeCMS does not generate or validate a per-request synchronizer token for sensitive administrative actions, nor does it check the Origin or Referer headers to confirm the request's source. Session cookies alone are used to authorize state changes, which is the defining precondition for CSRF.

Attack Vector

Exploitation occurs over the network and requires only that a logged-in administrator trigger the attacker-supplied payload. A typical attack flow:

The attacker hosts a page containing a hidden form that POSTs to the victim's DedeCMS instance at /src/dede/sys_safe.php with chosen parameters.
The administrator, already authenticated to the DedeCMS admin console, visits the malicious page.
The browser submits the forged request with valid session cookies, and the server processes it as a legitimate administrative action.

No authentication credentials are stolen; the attack abuses the trust the application places in the administrator's browser. Technical details are referenced in the public disclosure write-up and VulDB entry 263316.

Detection Methods for CVE-2024-4594

Indicators of Compromise

Unexpected modifications to DedeCMS security settings recorded in administrative audit logs.
Web server access log entries showing POST requests to /src/dede/sys_safe.php with a Referer header pointing to an external domain.
Administrative state-change requests lacking a corresponding prior GET of the admin page by the same session.

Detection Strategies

Alert on POST requests to /src/dede/sys_safe.php where the Referer or Origin header is absent or does not match the DedeCMS host.
Correlate admin configuration changes with user browsing telemetry to flag changes that coincide with visits to untrusted sites.
Deploy a web application firewall rule that enforces same-origin checks on DedeCMS administrative endpoints.

Monitoring Recommendations

Enable verbose access logging on the DedeCMS /dede/ directory and forward logs to a centralized SIEM.
Monitor for anomalous changes to sys_safe configuration values and generate alerts on each modification.
Review administrator session activity for geographic or user-agent anomalies that could indicate session abuse.

How to Mitigate CVE-2024-4594

Immediate Actions Required

Restrict access to the DedeCMS /dede/ administrative directory using IP allowlisting or VPN-only access.
Instruct administrators to log out of the DedeCMS console when not actively using it, and to avoid browsing untrusted sites in the same browser session.
Deploy a web application firewall rule that rejects requests to sys_safe.php lacking a same-origin Referer or Origin header.

Patch Information

At the time of publication the vendor has not released a security patch, and according to the advisory did not respond to the disclosure. Monitor the DedeCMS project channels and the VulDB record for updates. Organizations should evaluate migrating off DedeCMS 5.7 if the vendor remains unresponsive.

Workarounds

Place the DedeCMS admin interface behind an authenticating reverse proxy that enforces CSRF token validation.
Configure browsers used for DedeCMS administration with the SameSite=Strict cookie attribute, where modifiable, to prevent cross-site cookie transmission.
Isolate administrative sessions to a dedicated browser profile or workstation that is not used for general web browsing.

bash

# Example Nginx snippet enforcing a same-origin Referer check on the admin endpoint
location = /src/dede/sys_safe.php {
    if ($http_referer !~* "^https?://your-dedecms-host/") {
        return 403;
    }
    proxy_pass http://dedecms_backend;
}