CVE-2021-4131: Cross-Site Request Forgery (CSRF) (CWE-352)
value: livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 8.8
Published: 2021-12-18T07:15Z
Repository: https://github.com/livehelperchat/livehelperchat
Language: PHP
Files changed: lhc_web/design/defaulttheme/tpl/lhsystem/configuration_links/expirecache.tpl.php, lhc_web/modules/lhsystem/expirecache.php, lhc_web/modules/lhsystem/module.php
Commit date: 2021-12-17 01:14:35 -0500
Commit message: CSFR Token expire cache

Diff: diff --git a/lhc_web/design/defaulttheme/tpl/lhsystem/configuration_links/expirecache.tpl.php b/lhc_web/design/defaulttheme/tpl/lhsystem/configuration_links/expirecache.tpl.php
index b6961076c9..0e5d854213 100644
--- a/lhc_web/design/defaulttheme/tpl/lhsystem/configuration_links/expirecache.tpl.php
+++ b/lhc_web/design/defaulttheme/tpl/lhsystem/configuration_links/expirecache.tpl.php
@@ -1,3 +1,3 @@
 <?php if ($currentUser->hasAccessTo('lhsystem','expirecache')) : ?>		
-	<li><a href="<?php echo erLhcoreClassDesign::baseurl('system/expirecache')?>"><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('pagelayout/pagelayout','Clean cache');?></a></li>			
+	<li><a class="csfr-required" href="<?php echo erLhcoreClassDesign::baseurl('system/expirecache')?>"><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('pagelayout/pagelayout','Clean cache');?></a></li>
 <?php endif; ?>
\ No newline at end of file
diff --git a/lhc_web/modules/lhsystem/expirecache.php b/lhc_web/modules/lhsystem/expirecache.php
index f10ad7119c..79898c6721 100644
--- a/lhc_web/modules/lhsystem/expirecache.php
+++ b/lhc_web/modules/lhsystem/expirecache.php
@@ -1,7 +1,13 @@
 <?php
 
+$currentUser = erLhcoreClassUser::instance();
+
+if (!$currentUser->validateCSFRToken($Params['user_parameters_unordered']['csfr'])) {
+    die('Invalid CSFR Token');
+    exit;
+}
 
 $CacheManager = erConfigClassLhCacheConfig::getInstance();
 $CacheManager->expireCache(true);
 header('Location: ' . $_SERVER['HTTP_REFERER']);
 exit;
diff --git a/lhc_web/modules/lhsystem/module.php b/lhc_web/modules/lhsystem/module.php
index 70a12d5241..09864697fb 100644
--- a/lhc_web/modules/lhsystem/module.php
+++ b/lhc_web/modules/lhsystem/module.php
@@ -34,11 +34,12 @@ $ViewList['usersactions'] = array(
     'functions' => array( 'usersactions' )
 );
 
 $ViewList['expirecache'] = array(
     'params' => array(),
-    'functions' => array( 'expirecache' )
+    'functions' => array( 'expirecache' ),
+    'uparams' => array('csfr')
 );
 
 $ViewList['smtp'] = array(
     'params' => array(),
     'functions' => array( 'configuresmtp' )

Vulnerable code: 	<li><a href="<?php echo erLhcoreClassDesign::baseurl('system/expirecache')?>"><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('pagelayout/pagelayout','Clean cache');?></a></li>			
    'functions' => array( 'expirecache' )
Fixed code: 	<li><a class="csfr-required" href="<?php echo erLhcoreClassDesign::baseurl('system/expirecache')?>"><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('pagelayout/pagelayout','Clean cache');?></a></li>
$currentUser = erLhcoreClassUser::instance();

if (!$currentUser->validateCSFRToken($Params['user_parameters_unordered']['csfr'])) {
    die('Invalid CSFR Token');
    exit;
}
    'functions' => array( 'expirecache' ),
    'uparams' => array('csfr')