Cross Site Request Forgery in acknowledging Toast in sissbruecker/linkding

Valid

Reported on

May 18th 2022

Description

Hi there linkding maintainers, I would like to report a Cross site request forgery in acknowledging toast.

This is due to the use of GET method.

Install a local instance of linkding
Create admin user admin
Log in as admin and create a new toast
Go back to /bookmarks and see that the toast appears in search bar
Access the link /toasts/<toast-id>/acknowledge and see that the toast is forcefully acknowledged.

CSRF

toasts.py L10

We are processing your report and will contact the sissbruecker/linkding team within 24 hours. a year ago

We have contacted a member of the sissbruecker/linkding team and are waiting to hear back a year ago

Sascha Ißbrücker modified the Severity from Critical to None a year ago

commented a year ago

Maintainer

Thanks for the report, I lowered the severity to none, as you can't really do any harm with this.

The researcher has received a minor penalty to their credibility for miscalculating the severity: -1

Sascha Ißbrücker validated this vulnerability a year ago

justinp09010 has been awarded the disclosure bounty

The fix bounty is now up for grabs

The researcher's credibility has increased: +7

Sascha Ißbrücker marked this as fixed in 1.9.1 with commit 117160 a year ago

The fix bounty has been dropped

This vulnerability will not receive a CVE

to join this conversation