KrayinCRM 2.2.0 Pre-Auth Admin Takeover via Logic Flaw (CVE-2024-6142) Analysis and POC

Pre-Authentication Administrator Takeover Vulnerability in KrayinCRM 2.2.0 (CVE-2024-6142) Vulnerability Overview A logic flaw exists in the installation middleware of KrayinCRM 2.2.0, allowing unauthenticated attackers to override administrator account credentials by sending specific HTTP requests, thereby gaining full control of the system. Core Issues: The installation route is not protected by CSRF. The middleware allows AJAX requests to bypass redirection logic even after the application has been installed. The controller method directly updates the first record in the users table (hardcoded ID=1) without authentication, password verification, or rate limiting. Impact Scope Affected Version: KrayinCRM 2.2.0 CVSS Score: Critical (9.8) Attack Vector: Network Authentication Requirement: Unauthenticated Impact: Attackers can reset the administrator's password, email, and name, gaining complete backend control. Remediation 1. Remove or strictly restrict access to routes post-installation, ensuring these endpoints are unreachable after the installation is complete. 2. Remove special handling for AJAX requests in the middleware, or implement stricter checks for installation status. 3. Add authentication and authorization checks to the method, ensuring only authenticated administrators can perform this action. 4. Avoid hardcoding user IDs; instead, retrieve the target user via the current session or permission context. 5. Add CSRF protection to all installation-related API endpoints. 6. Log sensitive operations to facilitate auditing and tracking. POC Code Example Response: Exploitation Code for Login: --- > Note: This vulnerability allows attackers to directly overwrite administrator accounts without authentication, constituting a high-risk pre-authentication vulnerability. Immediate remediation is recommended.

Goal Reached Thanks to every supporter — we hit 100%!

KrayinCRM 2.2.0 Pre-Auth Admin Takeover via Logic Flaw (CVE-2024-6142) Analysis and POC