Birkir Prime Cross-Site Request Forgery Vulnerability in GraphQL Endpoint

A cross-site request forgery (CSRF) vulnerability has been identified in Birkir Prime versions through 0.4.0.beta.0. This vulnerability exists in the application's GraphQL endpoint, allowing attackers to exploit GET-based query requests. By manipulating GraphQL query parameters, attackers can craft malicious GET requests that trigger unauthorized actions against privileged users.

Impact

Exploitation of this vulnerability allows for cross-site request forgery attacks, where an attacker can perform actions on behalf of a privileged user without their consent.

Reproduction

To reproduce this vulnerability, send a GET request to the application's GraphQL endpoint with a crafted query that exploits the CSRF vulnerability. Include the appropriate headers to mimic a legitimate request.