Cross-Site Request Forgery (CSRF) in leantime/leantime


Reported on

Aug 17th 2021

✍️ Description

CSRF on deleting a user. There is no token or anti csrf implemented.

🕵️‍♂️ Proof of Concept

Create a .html file (poc.html) for example and copy paste the following code in it. Change localhost to ur domain or ip address.

<title>CSRF PoC</title>
<form action="http://localhost/users/delUser/2" method="POST">
<input type="text" name="del" value="Yes%252C+delete%2521" /><br />
<input type='submit' value='Go!' />

send this file to a admin when he opens the file the user with id 2 is getting deleted instantly. see the screenshot where there are still two users. alt text

screenshot when the admin decides to click on it alt text

after clicking on Go, the next screen is showed where the user with id 2 (test) no longer exists. alt text

💥 Impact

This vulnerability is capable of deleting an user account. If you send the admin the link and he clicks on it the user will be deleted instantly because there is no csrf protection. With this attack you can delete users.

💥 References

We have contacted a member of the leantime team and are waiting to hear back 9 months ago
Marcel Folaron validated this vulnerability 9 months ago
ribersec has been awarded the disclosure bounty
The fix bounty is now up for grabs
Marcel Folaron confirmed that a fix has been merged on c204bc a month ago
Marcel Folaron has been awarded the fix bounty
to join this conversation