CVE-2021-4082: Cross-Site Request Forgery (CSRF) (CWE-352)
value: pimcore is vulnerable to Cross-Site Request Forgery (CSRF)
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 4.3
Published: 2021-12-10T11:15Z
Repository: https://github.com/pimcore/pimcore
Language: Other
Files changed: bundles/AdminBundle/Controller/Admin/LoginController.php, bundles/AdminBundle/Resources/views/Admin/Index/index.html.twig, bundles/AdminBundle/Resources/views/Admin/Login/twoFactorAuthentication.html.twig
Commit date: 2021-12-09 11:18:46 +0100
Commit message: [Admin] Logout action should use POST method

Diff: diff --git a/bundles/AdminBundle/Controller/Admin/LoginController.php b/bundles/AdminBundle/Controller/Admin/LoginController.php
index c81c04ee0b9..fc121ef5fb5 100644
--- a/bundles/AdminBundle/Controller/Admin/LoginController.php
+++ b/bundles/AdminBundle/Controller/Admin/LoginController.php
@@ -143,11 +143,11 @@ class LoginController extends AdminController implements BruteforceProtectedCont
            'csrfToken' => $csrfProtection->getCsrfToken(),
         ]);
     }
 
     /**
-     * @Route("/logout", name="pimcore_admin_logout")
+     * @Route("/logout", name="pimcore_admin_logout" , methods={"POST"})
      */
     public function logoutAction()
     {
         // this route will never be matched, but will be handled by the logout handler
     }
diff --git a/bundles/AdminBundle/Resources/views/Admin/Index/index.html.twig b/bundles/AdminBundle/Resources/views/Admin/Index/index.html.twig
index d92ea411306..dd8da3b82b3 100644
--- a/bundles/AdminBundle/Resources/views/Admin/Index/index.html.twig
+++ b/bundles/AdminBundle/Resources/views/Admin/Index/index.html.twig
@@ -143,13 +143,19 @@
     </div>
 
     <div id="pimcore_avatar" style="display:none;">
         <img src="{{ path('pimcore_admin_user_getimage') }}" data-menu-tooltip="{{ user.name }} | {{ 'my_profile'|trans([],'admin') }}"/>
     </div>
-    <a id="pimcore_logout" data-menu-tooltip="{{ "logout"|trans([],'admin') }}" href="{{ path('pimcore_admin_logout') }}" style="display: none">
-        <img src="/bundles/pimcoreadmin/img/material-icons/outline-logout-24px.svg">
-    </a>
+
+    <form id="pimcore_logout_form" method="post" action="{{ path('pimcore_admin_logout') }}">
+        <input type="hidden" name="csrfToken" value="{{ pimcore_csrf.getCsrfToken() }}">
+
+        <a id="pimcore_logout" data-menu-tooltip="{{ "logout"|trans([],'admin') }}"
+           href="#" onclick="document.getElementById('pimcore_logout_form').submit();" style="display: none">
+            <img src="/bundles/pimcoreadmin/img/material-icons/outline-logout-24px.svg">
+        </a>
+    </form>
     <div id="pimcore_signet" data-menu-tooltip="Pimcore Platform ({{ settings.version }}|{{ settings.build }})" style="text-indent: -10000px">
         BE RESPECTFUL AND HONOR OUR WORK FOR FREE & OPEN SOURCE SOFTWARE BY NOT REMOVING OUR LOGO.
         WE OFFER YOU THE POSSIBILITY TO ADDITIONALLY ADD YOUR OWN LOGO IN PIMCORE'S SYSTEM SETTINGS. THANK YOU!
     </div>
 </div>
diff --git a/bundles/AdminBundle/Resources/views/Admin/Login/twoFactorAuthentication.html.twig b/bundles/AdminBundle/Resources/views/Admin/Login/twoFactorAuthentication.html.twig
index 2fa7e82b168..dab97371662 100644
--- a/bundles/AdminBundle/Resources/views/Admin/Login/twoFactorAuthentication.html.twig
+++ b/bundles/AdminBundle/Resources/views/Admin/Login/twoFactorAuthentication.html.twig
@@ -16,11 +16,16 @@
         <input type="hidden" name="csrfToken" value="{{ pimcore_csrf.getCsrfToken() }}">
 
         <button type="submit">{{ 'Login'|trans([],'admin') }}</button>
     </form>
 
-    <a href="{{ path('pimcore_admin_logout') }}">{{ 'Back to Login'|trans([],'admin') }}</a>
+    <form id="pimcore_logout_form" method="post" action="{{ path('pimcore_admin_logout') }}">
+        <input type="hidden" name="csrfToken" value="{{ pimcore_csrf.getCsrfToken() }}">
+        <a href="#" onclick="document.getElementById('pimcore_logout_form').submit();">{{ 'Back to Login'|trans([],'admin') }}</a>
+    </form>
+
+
 
     {{ pimcore_breach_attack_random_content() }}
 {% endblock %}
 
 

Vulnerable code:      * @Route("/logout", name="pimcore_admin_logout")
    <a id="pimcore_logout" data-menu-tooltip="{{ "logout"|trans([],'admin') }}" href="{{ path('pimcore_admin_logout') }}" style="display: none">
        <img src="/bundles/pimcoreadmin/img/material-icons/outline-logout-24px.svg">
    </a>
    <a href="{{ path('pimcore_admin_logout') }}">{{ 'Back to Login'|trans([],'admin') }}</a>
Fixed code:      * @Route("/logout", name="pimcore_admin_logout" , methods={"POST"})

    <form id="pimcore_logout_form" method="post" action="{{ path('pimcore_admin_logout') }}">
        <input type="hidden" name="csrfToken" value="{{ pimcore_csrf.getCsrfToken() }}">

        <a id="pimcore_logout" data-menu-tooltip="{{ "logout"|trans([],'admin') }}"
           href="#" onclick="document.getElementById('pimcore_logout_form').submit();" style="display: none">
            <img src="/bundles/pimcoreadmin/img/material-icons/outline-logout-24px.svg">
        </a>
    </form>
    <form id="pimcore_logout_form" method="post" action="{{ path('pimcore_admin_logout') }}">
        <input type="hidden" name="csrfToken" value="{{ pimcore_csrf.getCsrfToken() }}">
        <a href="#" onclick="document.getElementById('pimcore_logout_form').submit();">{{ 'Back to Login'|trans([],'admin') }}</a>
    </form>