CVE-2020-9388 - API Endpoints are not protected against CSRF

CVE: CVE-2020-9388

Description

Cross-Site Request Forgery (CSRF) is an attack that enables a malicious actor to execute unwanted actions. Before SquaredUp DS version 4.6, CSRF protection was not present for API endpoints.

This could be exploited by sending a SquaredUp DS user a link to a malicious site or implementing a forged request in a SquaredUp DS dashboard. When the malicious page is opened by the user, the request would be made to the SquaredUp DS API using the victim's session. For example, the malicious HTML code could make a successful request to add or remove users from the Named User list or upload a malicious SVG image (see CVE-2020-9390 - Stored cross-site scripting (Web Content tile)).

Fix

Since SquaredUp DS version 4.6, this vulnerability has been fixed. All requests are now validated using an appropriate token.

What should you do?

If you are using a SquaredUp DS version earlier than 4.6, update to version 4.6 or later.

Affected and resolved software versions

Acknowledgement

SquaredUp would like to thank Giuseppe-Diego Gianni from NATO for reporting this vulnerability.

Did you notice a vulnerability or need further help?

Revision history of this article