Cross-Site Request Forgery (CSRF) in myvesta/vesta


Reported on

Aug 24th 2021

✍️ Description

Attacker is able to logout user if a logged in user visits attacker website.

🕵️‍♂️ Proof of Concept

1.when you logged in open this POC.html in a browser can check unintentionally you logged out

<script>history.pushState('', '', '/')</script>
<form action="">
<input type="submit" value="Submit request" />

💥 Impact

This vulnerability is capable of forging admin or user to unintentional logout.

💥 Test

Tested on Edge, Firefox, chrome and safari.

📍 Location index.php#L3 📝 References csrf



We have contacted a member of the myvesta/vesta team and are waiting to hear back a year ago
Musio modified the report
a year ago
Musio modified the report
a year ago
a year ago


I think this will not be fixed, because we use /logout/ on so many places on hosting panel, without passing the token. More over, to quote the guy from HestiaCP (that is also affected with this 'issue'): "If we require token, it will mean that if I don't have that token I can't logout any more" "There are no issues, it just reduces usability... the only thing that can be done is logout the user..."

However, we implemented CSRF protection on the top level, checking both HTTP_ORIGIN and HTTP_REFERER -

I will confirm this CSRF, but I'm not sure if this can be considered as a fix.

myvesta validated this vulnerability a year ago
Musio has been awarded the disclosure bounty
The fix bounty is now up for grabs
a year ago


Looks like we are linking /logout/ only from 4 places. OK, we will add token there.

a year ago


Nice work, this may seems has a little impact but, as my friend says CSRF has impact when we can do an action on the database. in this situation attacker can invalidate user session therefore i report this kind issue every time i find.

and this is right that: "if i don't have token i must not can to logout."

myvesta confirmed that a fix has been merged on 9a746e a year ago
myvesta has been awarded the fix bounty
to join this conversation