Flask-MonitoringDashboard Cross-Site Request Forgery Vulnerability

A cross-site request forgery (CSRF) vulnerability exists in Flask-MonitoringDashboard versions through 5.0.2. The issue arises in the user creation endpoint, where the lack of CSRF protection allows an attacker to manipulate an authenticated administrator into creating a new admin account with attacker-chosen credentials. This vulnerability can be exploited remotely, leading to a persistent takeover of the monitoring dashboard.

Impact

Exploitation of this vulnerability allows for a permanent takeover of the Flask-MonitoringDashboard by creating an admin account controlled by the attacker. This access includes sensitive operational data such as request statistics, exception stack traces, and application source code via the API.

Reproduction

To reproduce this vulnerability, send a POST request to the '/api/user/create' endpoint without a CSRF token. Include a username, password, and set 'is_admin' to true. The request will be accepted, and a new admin user will be created.