Cotonti: Cross-Site Request Forgery in the administration rights handler
The advisory, in context
Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the administration rights handler. In system/admin/admin.rights.php, the rights update action ('a=update') modifies group access rights (including via cot_auth_add_group) without calling cot_check_xg() to validate the anti-CSRF token. A remote attacker who lures an authenticated administrator into visiting a malicious page can force the browser to submit a forged request that grants elevated permissions to an attacker-controlled group, escalating privileges to administrator. Because Cotonti administrators can modify templates and configuration, this can be further leveraged toward remote code execution.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
Earlier releases through 1.0.0 (inclusive)
No fix recorded for this interval.
6 explicitly affected versions
0.9.23, 0.9.24, 0.9.24.1, 0.9.24.2, 0.9.25, 1.0.0
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.0.0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.9.23",
"0.9.24",
"0.9.24.1",
"0.9.24.2",
"0.9.25",
"1.0.0"
]
}