CVE-2021-4005: Cross-Site Request Forgery (CSRF) (CWE-352)
value: firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 4.3
Published: 2021-12-04T12:15Z
Repository: https://github.com/firefly-iii/firefly-iii
Language: Other
Files changed: resources/views/v1/profile/index.twig
Commit date: 2021-11-24 20:04:39 +0100
Commit message: Fix.

Diff: diff --git a/resources/views/v1/profile/index.twig b/resources/views/v1/profile/index.twig
index 566cf5dcf4e..bf01b5411be 100644
--- a/resources/views/v1/profile/index.twig
+++ b/resources/views/v1/profile/index.twig
@@ -105,23 +105,24 @@
                 <!-- MFA -->
                 <div role="tabpanel" class="tab-pane" id="mfa">
                     <div class="box box-default">
                         <div class="box-body">
                             <p class="text-info">{{ 'pref_two_factor_auth_help'|_ }}</p>
-                            {% if enabled2FA == false %}
+                            {% if enabled2FA == true %}
                                 <p class="text-info">
                                     {{ trans_choice('firefly.pref_two_factor_backup_code_count', mfaBackupCount) }}
                                 </p>
 
                                 <div class="btn-group">
                                     <a class="btn btn-info" href="{{ route('profile.code') }}">
                                         <span class="fa fa-recycle"></span>
                                         {{ 'pref_two_factor_auth_reset_code'|_ }}</a>
-                                    <a class="btn btn-danger" href="{{ route('profile.delete-code') }}">
-                                        <span class="fa fa-trash"></span>
-                                        {{ 'pref_two_factor_auth_disable_2fa'|_ }}</a>
                                 </div>
+                                <form method="post" action="{{ route('profile.delete-code') }}">
+                                    <input type="hidden" name="_token" value="{{ csrf_token() }}" />
+                                    <input class="btn btn-danger" style="margin-top:20px;" type="submit" name="submit" value="{{ 'pref_two_factor_auth_disable_2fa'|_ }}" />
+                                </form>
                                 <form method="post" action="{{ route('profile.new-backup-codes') }}">
                                     <input type="hidden" name="_token" value="{{ csrf_token() }}" />
                                     <input class="btn btn-default" style="margin-top:20px;" type="submit" name="submit" value="{{ 'pref_two_factor_new_backup_codes'|_ }}" />
                                 </form>
                             {% else %}

Vulnerable code:                             {% if enabled2FA == false %}
                                    <a class="btn btn-danger" href="{{ route('profile.delete-code') }}">
                                        <span class="fa fa-trash"></span>
                                        {{ 'pref_two_factor_auth_disable_2fa'|_ }}</a>
Fixed code:                             {% if enabled2FA == true %}
                                <form method="post" action="{{ route('profile.delete-code') }}">
                                    <input type="hidden" name="_token" value="{{ csrf_token() }}" />
                                    <input class="btn btn-danger" style="margin-top:20px;" type="submit" name="submit" value="{{ 'pref_two_factor_auth_disable_2fa'|_ }}" />
                                </form>