CVE-2024-26349 in flusity
Summary
by MITRE • 02/22/2024
flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /core/tools/delete_translation.php
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 04/18/2025
The vulnerability identified as CVE-2024-26349 affects flusity-CMS version 2.33 and represents a critical Cross-Site Request Forgery flaw that could enable attackers to perform unauthorized actions on behalf of authenticated users. This vulnerability specifically resides within the /core/tools/delete_translation.php component of the content management system, making it a targeted attack vector for malicious actors seeking to exploit user sessions and manipulate the CMS functionality. The flaw allows an attacker to craft malicious requests that would be executed by a victim's browser when the victim visits a compromised website or clicks on a malicious link, thereby bypassing the normal authentication and authorization mechanisms that should protect the system.
The technical implementation of this CSRF vulnerability stems from the absence of proper anti-CSRF tokens or validation mechanisms within the delete_translation.php endpoint. When a user accesses this component to delete translation files, the application fails to verify the authenticity of the request source, relying instead on the user's existing session credentials. This design flaw aligns with CWE-352, which specifically addresses Cross-Site Request Forgery vulnerabilities where applications fail to validate that requests originate from legitimate sources. The vulnerability operates under the principle that authenticated users can be tricked into executing unwanted actions without their knowledge or consent, making it particularly dangerous in web applications where users maintain elevated privileges.
The operational impact of this vulnerability extends beyond simple data manipulation, as it could potentially allow attackers to compromise the integrity and availability of the CMS translation system. An attacker could leverage this flaw to delete critical translation files, disrupt multilingual content delivery, or potentially gain deeper access to the system by removing components necessary for proper operation. The consequences could include complete translation functionality disruption, data loss, and potential cascading effects on user experience across multiple languages. This vulnerability particularly affects content management systems where translation capabilities are integral to the platform's functionality, as it directly impacts the ability to maintain multilingual content and user accessibility.
Security mitigations for this CSRF vulnerability should focus on implementing robust anti-CSRF token mechanisms within the delete_translation.php component and all similar administrative endpoints. The solution involves generating unique, unpredictable tokens for each user session and requiring their validation before processing any destructive operations. This approach directly addresses the ATT&CK technique T1566.002 which involves exploiting web applications through CSRF attacks. Additionally, implementing proper origin validation and implementing the SameSite cookie attributes would provide additional layers of protection. Organizations should also consider implementing Content Security Policy headers to limit the sources from which scripts can be executed, and conduct regular security audits to identify similar vulnerabilities in other components of the CMS. The patch for this vulnerability would require developers to ensure that all state-changing operations within the CMS include proper CSRF protection mechanisms, following industry best practices for web application security and aligning with OWASP Top Ten recommendations for preventing CSRF attacks.