CVE-2021-4049: Cross-Site Request Forgery (CSRF) (CWE-352)
value: livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 6.5
Published: 2021-12-07T11:15Z
Repository: https://github.com/livehelperchat/livehelperchat
Language: PHP
Files changed: lhc_web/design/defaulttheme/tpl/lhuser/wentinactive.tpl.php, lhc_web/design/defaulttheme/tpl/pagelayouts/parts/user_box.tpl.php, lhc_web/modules/lhuser/logout.php, lhc_web/modules/lhuser/module.php
Commit date: 2021-12-07 04:11:58 -0500
Commit message: csrf for logout url

Diff: diff --git a/lhc_web/design/defaulttheme/tpl/lhuser/wentinactive.tpl.php b/lhc_web/design/defaulttheme/tpl/lhuser/wentinactive.tpl.php
index dda6c9483..05530351c 100644
--- a/lhc_web/design/defaulttheme/tpl/lhuser/wentinactive.tpl.php
+++ b/lhc_web/design/defaulttheme/tpl/lhuser/wentinactive.tpl.php
@@ -3,8 +3,8 @@
 
 <p><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('user/wentinactive','Because of inactivity you went offline, click continue to go online.');?></p>
 
 <button type="button" class="btn btn-success" data-dismiss="modal" aria-label="Close"><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('user/wentinactive','Continue');?></button>
 
-<a class="btn btn-secondary btn-warning float-right" href="<?php echo erLhcoreClassDesign::baseurl('user/logout')?>"><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('user/wentinactive','Logout');?></a>
+<a class="btn btn-secondary btn-warning float-right" onclick="$(this).attr('href',$(this).attr('href')+'/(csfr)/'+confLH.csrf_token)" href="<?php echo erLhcoreClassDesign::baseurl('user/logout')?>"><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('user/wentinactive','Logout');?></a>
 
 <?php include(erLhcoreClassDesign::designtpl('lhkernel/modal_footer.tpl.php'));?>
\ No newline at end of file
diff --git a/lhc_web/design/defaulttheme/tpl/pagelayouts/parts/user_box.tpl.php b/lhc_web/design/defaulttheme/tpl/pagelayouts/parts/user_box.tpl.php
index ed164cff6..9a908b970 100644
--- a/lhc_web/design/defaulttheme/tpl/pagelayouts/parts/user_box.tpl.php
+++ b/lhc_web/design/defaulttheme/tpl/pagelayouts/parts/user_box.tpl.php
@@ -28,11 +28,11 @@ if ($UserData->force_logout == 1) {
             <?php endif; ?>
             <div class="col-6">
                 <a title="<?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('chat/user_settings','Toggle between dark and white themes');?>" href="<?php echo erLhcoreClassDesign::baseurl('front/switchdashboard')?>/(action)/mode" class="dropdown-item pl-2"><span class="material-icons">settings_brightness</span><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('pagelayout/pagelayout','Dark/bright');?></a>
             </div>
             <div class="col-6">
-                <a class="dropdown-item pl-2" href="<?php echo erLhcoreClassDesign::baseurl('user/logout')?>" title="<?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('pagelayout/pagelayout','Logout');?>"><i class="material-icons">exit_to_app</i><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('pagelayout/pagelayout','Logout');?></a>
+                <a class="dropdown-item pl-2" onclick="$(this).attr('href',$(this).attr('href')+'/(csfr)/'+confLH.csrf_token)" href="<?php echo erLhcoreClassDesign::baseurl('user/logout')?>" title="<?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('pagelayout/pagelayout','Logout');?>"><i class="material-icons">exit_to_app</i><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('pagelayout/pagelayout','Logout');?></a>
             </div>
         </div>
 
 
         <hr class="m-0">
diff --git a/lhc_web/modules/lhuser/logout.php b/lhc_web/modules/lhuser/logout.php
index 1846b637c..aab3351e6 100644
--- a/lhc_web/modules/lhuser/logout.php
+++ b/lhc_web/modules/lhuser/logout.php
@@ -2,15 +2,20 @@
 
 header('X-Frame-Options: DENY');
 
 $lhUser = erLhcoreClassUser::instance();
 
+if (!$lhUser->isLogged() || !$lhUser->validateCSFRToken($Params['user_parameters_unordered']['csfr'])) {
+    die('Invalid CSFR Token');
+    exit;
+}
+
 erLhcoreClassChatEventDispatcher::getInstance()->dispatch('user.logout',array('user' => & $lhUser));
 
 $lhUser->logout();
 
 erLhcoreClassChatEventDispatcher::getInstance()->dispatch('user.after_logout',array('user' => & $lhUser));
 
-erLhcoreClassModule::redirect('user/login');
+//erLhcoreClassModule::redirect('user/login');
 exit;
 
 ?>
\ No newline at end of file
diff --git a/lhc_web/modules/lhuser/module.php b/lhc_web/modules/lhuser/module.php
index 31de060b1..0fcacb1d8 100644
--- a/lhc_web/modules/lhuser/module.php
+++ b/lhc_web/modules/lhuser/module.php
@@ -18,11 +18,12 @@ $ViewList['autologinuser'] = array(
     'params' => array('hash'),
     'uparams' => array(),
 );
 
 $ViewList['logout'] = array(
-    'params' => array()
+    'params' => array(),
+    'uparams' => array('csfr')
 );
 
 $ViewList['loginas'] = array(
     'params' => array('id'),
     'functions' => array( 'loginas' )

Vulnerable code: <a class="btn btn-secondary btn-warning float-right" href="<?php echo erLhcoreClassDesign::baseurl('user/logout')?>"><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('user/wentinactive','Logout');?></a>
                <a class="dropdown-item pl-2" href="<?php echo erLhcoreClassDesign::baseurl('user/logout')?>" title="<?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('pagelayout/pagelayout','Logout');?>"><i class="material-icons">exit_to_app</i><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('pagelayout/pagelayout','Logout');?></a>
erLhcoreClassModule::redirect('user/login');
    'params' => array()
Fixed code: <a class="btn btn-secondary btn-warning float-right" onclick="$(this).attr('href',$(this).attr('href')+'/(csfr)/'+confLH.csrf_token)" href="<?php echo erLhcoreClassDesign::baseurl('user/logout')?>"><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('user/wentinactive','Logout');?></a>
                <a class="dropdown-item pl-2" onclick="$(this).attr('href',$(this).attr('href')+'/(csfr)/'+confLH.csrf_token)" href="<?php echo erLhcoreClassDesign::baseurl('user/logout')?>" title="<?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('pagelayout/pagelayout','Logout');?>"><i class="material-icons">exit_to_app</i><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('pagelayout/pagelayout','Logout');?></a>
if (!$lhUser->isLogged() || !$lhUser->validateCSFRToken($Params['user_parameters_unordered']['csfr'])) {
    die('Invalid CSFR Token');
    exit;
}

//erLhcoreClassModule::redirect('user/login');
    'params' => array(),
    'uparams' => array('csfr')