CVE-2024-46085: FrogCMS Cross-Site Request Forgery Vulnerability

CVE-2024-46085 Overview

CVE-2024-46085 is a Cross-Site Request Forgery (CSRF) vulnerability in FrogCMS version 0.9.5. The flaw resides in the file manager plugin endpoint at /admin/?/plugin/file_manager/rename. An attacker can craft a malicious web page that, when visited by an authenticated administrator, triggers unauthorized file rename operations within the CMS. The issue is tracked under CWE-352: Cross-Site Request Forgery.

Critical Impact
Authenticated administrators visiting an attacker-controlled page can be forced to rename files on the FrogCMS server, leading to integrity loss, denial of service, and potential code execution if scripts are repurposed.

Affected Products

FrogCMS 0.9.5
FrogCMS file_manager plugin
Administrative interface at /admin/?/plugin/file_manager/rename

Discovery Timeline

2024-09-17 - CVE-2024-46085 published to the National Vulnerability Database
2025-04-28 - Last updated in NVD database

Technical Details for CVE-2024-46085

Vulnerability Analysis

FrogCMS 0.9.5 exposes a file rename action through its administrative file manager plugin without verifying the origin of the request. The endpoint /admin/?/plugin/file_manager/rename accepts state-changing operations using only the administrator's session cookie for authorization. Because no anti-CSRF token or equivalent origin check is enforced, browsers automatically attach the admin session cookie to cross-origin requests, allowing the action to proceed on behalf of the victim. Exploitation requires user interaction, since the targeted administrator must visit or be redirected to a page controlled by the attacker.

Root Cause

The root cause is missing CSRF protection on a state-changing administrative endpoint. The file_manager/rename handler does not validate a per-session token, the HTTP Origin header, or the Referer header before performing the rename operation. This classifies the issue under CWE-352, where the application cannot distinguish between requests initiated by the user and those forged by a third-party site.

Attack Vector

The attack is network-based and requires the victim administrator to be authenticated to FrogCMS while loading attacker-controlled content. The adversary hosts an HTML page containing an auto-submitting form or image tag that issues a request to the vulnerable rename endpoint with attacker-chosen old and new filename parameters. The browser supplies the administrator's session cookie automatically, causing the server to execute the rename. Renaming files such as .htaccess, configuration files, or PHP templates can break the site, leak source code, or set up subsequent exploitation paths. Technical proof-of-concept details are available in the GitHub PoC Repository.

Detection Methods for CVE-2024-46085

Indicators of Compromise

Unexpected entries in web server access logs showing POST or GET requests to /admin/?/plugin/file_manager/rename with Referer headers pointing to external or unfamiliar domains.
File rename events in the FrogCMS file manager that do not correlate with legitimate administrator activity windows.
Sudden absence or renaming of critical files such as .htaccess, index.php, or template files within the FrogCMS document root.

Detection Strategies

Inspect HTTP request logs for administrative actions where the Referer or Origin header does not match the FrogCMS host.
Correlate file system change events on the web root with authenticated admin session activity to identify forged requests.
Alert on any access to /admin/?/plugin/file_manager/rename originating from non-administrative user agents or unusual geographies.

Monitoring Recommendations

Enable verbose web server logging including Referer, Origin, and full request URIs for all /admin/ paths.
Deploy file integrity monitoring on the FrogCMS document root to detect unauthorized rename or move operations.
Forward web and file integrity logs to a centralized SIEM and build detections that pivot on the rename endpoint pattern.

How to Mitigate CVE-2024-46085

Immediate Actions Required

Restrict access to the FrogCMS /admin/ interface using IP allowlists, VPN, or HTTP basic authentication at the web server layer.
Require administrators to log out of FrogCMS when not actively performing maintenance to shorten the window of CSRF exposure.
Audit the web root for unexpected file renames and restore affected files from known-good backups.

Patch Information

No official vendor patch is referenced in the NVD entry for FrogCMS 0.9.5. Because FrogCMS is no longer actively maintained, organizations should plan migration to a supported content management system. Until migration is complete, apply compensating controls described in the workarounds section and consult the GitHub PoC Repository for technical details of the vulnerable request.

Workarounds

Place the /admin/ directory behind an authenticating reverse proxy that injects and validates a CSRF token on all state-changing requests.
Configure the web server to reject requests to /admin/?/plugin/file_manager/rename whose Origin or Referer header does not match the FrogCMS hostname.
Set session cookies with the SameSite=Strict attribute so that cross-site requests do not carry administrator credentials.
Disable or remove the file_manager plugin if it is not required for daily operations.

bash

# Example nginx snippet to block cross-origin requests to the vulnerable endpoint
location ~ ^/admin/ {
    if ($http_referer !~* "^https?://your-frogcms-host/") {
        return 403;
    }
    # Enforce SameSite on session cookies
    proxy_cookie_path / "/; SameSite=Strict; HttpOnly; Secure";
    proxy_pass http://frogcms_backend;
}