Cotonti: Cross-Site Request Forgery in the Personal File Storage (PFS) module
The advisory, in context
Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the Personal File Storage (PFS) module. In modules/pfs/inc/pfs.main.php, the file upload action ('a=upload') processes uploaded files without calling cot_check_xg() to validate the anti-CSRF token, even though sibling actions such as 'delete' (line 272) do. A remote attacker who lures an authenticated user into visiting a malicious page can force the browser to submit a forged multipart request that uploads arbitrary files into the victim's PFS storage.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
Earlier releases through 1.0.0 (inclusive)
No fix recorded for this interval.
6 explicitly affected versions
0.9.23, 0.9.24, 0.9.24.1, 0.9.24.2, 0.9.25, 1.0.0
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.0.0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.9.23",
"0.9.24",
"0.9.24.1",
"0.9.24.2",
"0.9.25",
"1.0.0"
]
}