Today we are going to take a deep dive into CVE-2024-24701, which addresses a Cross-Site Request Forgery (CSRF) vulnerability discovered in Native Grid LLC's popular website development tool, A No-code Page Builder for Beautiful Performance-based Content. This vulnerability affects A No-code Page Builder for Beautiful Performance-based Content versions n/a through 2.1.20.

For those unfamiliar with Cross-Site Request Forgery, it is a type of web security vulnerability that allows an attacker to trick an on-site user into performing actions they do not intend to do. This can result in unauthorized data changes or the complete hijacking of user accounts.

In this extensive post, we will dive into the details of this exploit, including the vulnerable code snippet, original references, and more. We aim to provide a simple explanation so that anyone can understand the issue and take necessary precautions to protect their websites.

Vulnerability Details

Native Grid LLC's A No-code Page Builder for Beautiful Performance-based Content is designed to provide an easy-to-use platform for website creation without the need for coding skills. However, a critical security flaw has been discovered in their page builder that allows Cross-Site Request Forgery attacks to be executed.

Here is the vulnerable code snippet

<form method="post" action="/page_builder/update_page_details">
    <input type="hidden" name="page_id" value="12345">
    <input type="text" name="new_page_name" placeholder="Enter new page name">
    <input type="submit" value="Update Page Name">
</form>

As you can see, this form is designed to allow users to update the name of a page within their website using the page builder. However, it does not include any form of CSRF protection, such as CSRF tokens, which would help protect the user from unauthorized actions.

Exploitation

To exploit this vulnerability, an attacker could craft a malicious webpage that contains a similar form, as shown below:

<form method="post" action="https://www.vulnerable-page-builder.com/page_builder/update_page_details">;
    <input type="hidden" name="page_id" value="12345">
    <input type="hidden" name="new_page_name" value="Malicious Page">
    <input type="submit" value="Click here to claim your prize!">
</form>

If an unsuspecting user, who is already logged into their page builder account, visits this malicious webpage and clicks on the "Click here to claim your prize!" button, the form will be submitted to the vulnerable page builder website, updating the page name without the user's consent. This can be further automated by including a piece of JavaScript that submits the form as soon as the page loads.

Mitigation

To mitigate this vulnerability, Native Grid LLC should implement a CSRF token generation system that validates forms before processing any requests. An example of how to include CSRF protection in the above code snippet is shown below:

<form method="post" action="/page_builder/update_page_details">
    <input type="hidden" name="page_id" value="12345">
    <input type="hidden" name="csrf_token" value="GENERATED_CSRF_TOKEN">
    <input type="text" name="new_page_name" placeholder="Enter new page name">
    <input type="submit" value="Update Page Name">
</form>

This CSRF token should be generated on the server-side and tied to the user's session, ensuring that it can only be submitted by the legitimate user who originally received it.

Conclusion and References

By addressing this CSRF vulnerability in their page builder tool, Native Grid LLC can protect its users from unauthorized data changes and potential account takeovers. It is important for all web application developers to be aware of CSRF attacks and implement proper protection mechanisms to avoid becoming victims themselves.

For more information and details about this CVE, please visit the following resources

1. CVE-2024-24701 Official Record
2. OWASP's Guide to CSRF Prevention_Prevention_Cheat_Sheet)
3. MDN Web Docs: CSRF Guide

Stay safe and keep building beautiful, performance-based content without compromising the security of your users.

Timeline

Published on: 02/29/2024 01:44:12 UTC
Last modified on: 02/29/2024 13:49:29 UTC