Cross-Site Request Forgery (CSRF) in myvesta/vesta


Reported on

Aug 24th 2021

✍️ Description

The download/web-log endpoint does not have CSRF Protection. This could be used to force download access log and potentially sensitive information leakage.

πŸ•΅οΈβ€β™‚οΈ Proof of Concept

Login to user account. Create the following POC.html file and open the page in browser.

<h2>To verify that you are a human, upload the file that has been downloaded from our website now.</h2>
<script>history.pushState('', '', '/')</script>
<form action="">
<input type="hidden" name="domain" value="demo&#46;myvesta&#46;com" />
<input type="hidden" name="type" value="access" />
<input type="submit" value="Submit request" />

This POC.html downloads user's data from the application without user's permission. An attacker can then cheat the user to upload this file into an attacker controlled server.

πŸ’₯ Impact

Potential private information leakage through phishing by exploiting missing CSRF token.

πŸ’₯ Test

Tested on Edge, Firefox, chrome and safari.

πŸ’₯ Fix

You should set a CSRF token on such GET requests. πŸ“ Location index.php#L1 πŸ“ References csrf πŸ“ Location index.php#L1 πŸ“ References csrf



We have contacted a member of the myvesta/vesta team and are waiting to hear back 2 years ago
Musio modified the report
2 years ago
Musio modified the report
2 years ago
myvesta validated this vulnerability 2 years ago
Musio has been awarded the disclosure bounty
The fix bounty is now up for grabs
myvesta marked this as fixed with commit 63861e 2 years ago
myvesta has been awarded the fix bounty
This vulnerability will not receive a CVE
to join this conversation