Tianti Cross-Site Request Forgery Vulnerability in User Status Update Component

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in Tianti version 2.3. This issue allows attackers to perform arbitrary actions by sending crafted GET or POST requests to the '/user/ajax/upd/status' component. The vulnerability arises from the absence of CSRF protection, such as verification tokens or same-origin policy checks, enabling exploitation by inducing users to unknowingly execute actions on their behalf.

Impact

Exploitation of this vulnerability could lead to unauthorized actions being performed on behalf of the user, such as modifying user status or other related functions, depending on the specific operations available through the vulnerable endpoints.

Reproduction

To reproduce this vulnerability, log into a Tianti 2.3 CMS account and navigate to the user management interface. Use Burp Suite to intercept the request when performing actions such as 'Add', 'Delete', 'Edit', or 'Restore' user functions. After capturing the request, remove the CSRF protection elements, if any, and send the modified request. This will simulate a CSRF attack by exploiting the lack of proper CSRF safeguards in the application.

Remediation

To address this vulnerability, implement CSRF tokens for verification on all state-changing requests. Additionally, establish same-origin policy checks on the server side to ensure that requests originate from trusted sources.