CVE-2024-9847: FlatPress CMS CSRF Plugin Control Vulnerability

CVE-2024-9847 Overview

CVE-2024-9847 is a Cross-Site Request Forgery (CSRF) vulnerability in FlatPress CMS that allows attackers to enable or disable plugins on behalf of an authenticated user. The flaw exists because FlatPress plugin management endpoints do not validate anti-CSRF tokens on state-changing requests. An attacker who convinces an authenticated administrator to visit a crafted page can trigger plugin toggle actions using the victim's session. The vulnerability is tracked under CWE-352 and is fixed in FlatPress version 1.4.dev.

Critical Impact
Successful exploitation lets an attacker silently activate or deactivate plugins on a targeted FlatPress site, which can disable security features or enable attacker-controlled code paths.

Affected Products

FlatPress CMS (all versions prior to 1.4.dev)
Vendor: flatpress
Component: flatpress:flatpress

Discovery Timeline

2025-03-20 - CVE-2024-9847 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9847

Vulnerability Analysis

FlatPress CMS exposes administrative plugin management actions through authenticated HTTP requests. The affected endpoints accept requests without verifying an anti-CSRF token or checking the request origin. When an authenticated administrator loads an attacker-controlled page, the browser sends the session cookie alongside the forged request, and the server executes the plugin toggle as if the administrator issued it.

The attacker does not need to steal credentials or read the response. Because the action is state-changing (enable or disable plugin), the write itself achieves the attacker's goal. Disabling a security-relevant plugin can reduce site defenses, while enabling a stale or vulnerable plugin can expand the attack surface for follow-on exploitation.

Root Cause

The root cause is missing CSRF protection on FlatPress administrative forms and action handlers. The maintainers' fix, delivered in commit a81c968f51f134b5e5f9bbe208aa12f4fbc329df, restructures admin templates so that state-changing actions are wrapped in the {html_form} construct. This helper emits the form with framework-generated hidden fields used for request validation, ensuring that forged cross-origin requests without a valid token are rejected.

Attack Vector

Exploitation is network-based and requires no authentication from the attacker, but does require an authenticated victim to load attacker-supplied HTML or click a malicious link. A typical payload is an auto-submitting HTML form or an <img> tag pointing at the vulnerable admin endpoint. The request executes under the victim's cookies and the server processes it without token verification.

php

// Security patch excerpt from admin/panels/entry/admin.entry.delete.tpl
// Source: https://github.com/flatpressblog/flatpress/commit/a81c968f51f134b5e5f9bbe208aa12f4fbc329df

<h2>{$panelstrings.head}</h2>
<p>{$panelstrings.descr}</p>
{entry_block}
    <fieldset id="post-preview"><legend>{$panelstrings.preview}</legend>
    {include file="preview.tpl"}
    </fieldset>
    <p>{$panelstrings.confirm}</p>

    {html_form}
        <input type="hidden" name="entry" value="{$id}">
        <div class="buttonbar">
        {html_submit name="delete" id="delete" value=$panelstrings.ok}
        {html_submit name="cancel" id="cancel" value=$panelstrings.cancel}
        </div>
    {/html_form}
{/entry_block}

The patch moves state-changing inputs inside the {html_form} block, which is responsible for injecting CSRF token fields validated on submission. See the FlatPress commit for the full fix.

Detection Methods for CVE-2024-9847

Indicators of Compromise

Unexpected plugin state changes recorded in FlatPress configuration files under fp-content/config/.
Administrative HTTP requests to plugin management endpoints with a Referer header pointing to an external or unrelated domain.
Access logs showing admin actions performed immediately after the administrator visited an untrusted external site.
Plugins enabled or disabled outside of documented change-management windows.

Detection Strategies

Compare current plugin configuration state against a known-good baseline and alert on drift.
Inspect web server access logs for POST requests to FlatPress admin scripts where the Referer header is missing or off-site.
Correlate administrator browsing telemetry with subsequent admin actions to identify likely CSRF-driven changes.

Monitoring Recommendations

Enable verbose logging on the FlatPress admin panel and forward logs to a central store for retention and analysis.
Alert on any modification to plugin configuration files or the plugin registry.
Monitor administrator user-agent strings and source IPs for anomalous sessions triggering admin actions.

How to Mitigate CVE-2024-9847

Immediate Actions Required

Upgrade FlatPress to version 1.4.dev or later, which includes the CSRF token enforcement fix from commit a81c968f.
Audit the plugin list on every FlatPress installation and disable any plugin that was not authorized by an administrator.
Require administrators to log out of FlatPress before browsing untrusted sites until the patch is applied.

Patch Information

The vulnerability is fixed in FlatPress 1.4.dev. The upstream fix is committed in flatpressblog/flatpress@a81c968. Additional context is available in the Huntr bounty report.

Workarounds

Restrict access to the FlatPress admin.php endpoint using web server ACLs or an authenticated reverse proxy that enforces SameSite=Strict cookies.
Deploy a web application firewall rule that rejects POST requests to FlatPress admin URLs when the Referer or Origin header does not match the site's own domain.
Instruct administrators to use a dedicated browser profile for FlatPress administration to reduce cross-site request exposure.

bash

# Example nginx configuration to block cross-origin POSTs to FlatPress admin
location /admin.php {
    if ($request_method = POST) {
        set $csrf_check "";
        if ($http_origin !~* "^https?://your-flatpress-domain\.example$") {
            set $csrf_check "deny";
        }
        if ($csrf_check = "deny") {
            return 403;
        }
    }
    try_files $uri =404;
}