Frappe Press CSRF-Like Vulnerability in API Secret Generation Endpoint

A vulnerability allowing CSRF-like exploits has been identified in the `create_api_secret` endpoint of the Frappe Press custom application, which manages various aspects of Frappe Cloud. This endpoint, accessible via the GET method, writes to the database and is susceptible to Cross-Site Request Forgery (CSRF) attacks. The issue arises because the endpoint was not properly restricted to a safer HTTP method, allowing potential exploitation.

Impact

Exploitation of this vulnerability could lead to unauthorized API secret generation, allowing users to impersonate others or gain unauthorized access to resources or functionalities.

Remediation

Users can update to version 52ea2f2d1b587be0807557e96f025f47897d00fd, where this vulnerability has been patched by restricting the `create_api_secret` endpoint to the POST method.