Cross-Site Request Forgery (CSRF) in emoncms/dashboard

Valid

Reported on

Jul 22nd 2021


ūüí• BUG

csrf bug to regenerate api-key

ūüí• STEP TO REPRODUCE

  1. First login into your account and open the link http://localhost/emoncms/user/newapikeywrite.json and a new api key will be generated.

ūüí• IMPACT

Any attacker can send those link to vicitm and when vicitm open the link then api-key will be changed

ūüí• STUDY

https://portswigger.net/web-security/csrf
https://www.imperva.com/learn/application-security/csrf-cross-site-request-forgery/
https://owasp.org/www-community/attacks/csrf\

We have contacted a member of the emoncms/dashboard team and are waiting to hear back 4 months ago
A emoncms/dashboard maintainer validated this vulnerability 4 months ago
ranjit-git has been awarded the disclosure bounty
The fix bounty is now up for grabs
A emoncms/dashboard maintainer
4 months ago

Maintainer


Here's the fix in the core repo https://github.com/emoncms/emoncms/commit/5e08ec969c1a1ceb483e2ef08bb2073f981ceada

I will link last commit in the dashboard repo to close this issue.

Thanks again!

A emoncms/dashboard maintainer confirmed that a fix has been merged on 58af4f 4 months ago
The fix bounty has been dropped