Cross Site Request Forgery in acknowledging Toast in sissbruecker/linkding
May 18th 2022
Hi there linkding maintainers, I would like to report a Cross site request forgery in acknowledging toast.
This is due to the use of GET method.
Proof of Concept
- Install a local instance of linkding
- Create admin user
- Log in as
adminand create a new toast
- Go back to
/bookmarksand see that the toast appears in search bar
- Access the link
/toasts/<toast-id>/acknowledgeand see that the toast is forcefully acknowledged.
We are processing your report and will contact the sissbruecker/linkding team within 24 hours. a year ago
We have contacted a member of the sissbruecker/linkding team and are waiting to hear back a year ago
Sascha Ißbrücker Sascha
commented a year ago
Thanks for the report, I lowered the severity to none, as you can't really do any harm with this.
The researcher has received a minor penalty to their credibility for miscalculating the severity: -1
Sascha Ißbrücker validated this vulnerability a year ago
justinp09010 has been awarded the disclosure bounty
The fix bounty is now up for grabs
The researcher's credibility has increased: +7
Sascha Ißbrücker marked this as fixed in 1.9.1 with commit 117160 a year ago
The fix bounty has been dropped
This vulnerability will not receive a CVE
to join this conversation