CVE-2022-4646 (Python, published 2022-12-22T02:15Z)
Description: value: Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.5.4.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/ikus060/rdiffweb
Files changed:
README.md
rdiffweb/controller/tests/test_controller.py
rdiffweb/controller/tests/test_page_admin_users.py
rdiffweb/controller/tests/test_page_login.py
rdiffweb/controller/tests/test_page_mfa.py
rdiffweb/controller/tests/test_secure_headers.py
rdiffweb/templates/layout.html
rdiffweb/templates/mfa.html
rdiffweb/test.py
rdiffweb/tools/auth_form.py
Commit message: Add CSRF verification on `/logout`


Vulnerable code:
* Create proper symbolic link of chartkick.js on Ubuntu Jammy to fix loading of Charts in web interface
        self.getPage('/logout')
        self.getPage("/logout")
        self.getPage('/logout/')
        self.getPage('/logout')
        self.getPage('/logout')
        self.getPage("/logout")
            ('/logout', 303),
                <div aria-labelledby="navbarDropdown" class="dropdown-menu">
                  <h6 class="dropdown-header">{% trans %}Signed in as{% endtrans %} {{ username }}</h6>
                  <a class="dropdown-item" href="{{ url_for('prefs', 'general') }}">{% trans %}Edit profile{% endtrans %}</a>
                  <a class="dropdown-item" href="{{ url_for('prefs', 'notification') }}">{% trans %}Notifications{% endtrans %}</a>
                  <div class="dropdown-divider"></div>
                  <a class="dropdown-item" href="{{ url_for('logout') }}">Logout</a>
                </div>
        <a class="btn-link btn-sm btn-block text-center"
           href="{{ url_for('logout')}}">
          {% trans %}Login with a different account{% endtrans %}
        </a>
        self.getPage("/logout")

Fixed code:
* Create proper symbolic link of `chartkick.js` on Ubuntu Jammy to fix loading of Charts in web interface
* Add CSRF verification on `/logout` credits to [reza.duty](https://rezaduty.me)
        self.getPage('/logout', method="POST")
        self.getPage("/logout", method="POST")
        self.getPage('/logout', method="POST")
        self.getPage('/logout', method="POST")
        self.getPage('/logout', method="POST")
        self.getPage("/logout", method="POST")
            ('/logout', 405),
                <form action="{{ url_for('logout') }}" method="post">
                  <div aria-labelledby="navbarDropdown" class="dropdown-menu">
                    <h6 class="dropdown-header">{% trans %}Signed in as{% endtrans %} {{ username }}</h6>
                    <a class="dropdown-item" href="{{ url_for('prefs', 'general') }}">{% trans %}Edit profile{% endtrans %}</a>
                    <a class="dropdown-item" href="{{ url_for('prefs', 'notification') }}">{% trans %}Notifications{% endtrans %}</a>
                    <div class="dropdown-divider"></div>
                    {# Logout button #}
                    <button type="submit" class="dropdown-item">{% trans %}Logout{% endtrans %}</button>
                  </div>
                </form>
        {# Logout button #}
        <form action="{{ url_for('logout') }}" method="post">
          <button type="submit" class="btn btn-link btn-sm btn-block text-center">
            {% trans %}Login with a different account{% endtrans %}
          </button>
        </form>
        self.getPage("/logout", method="POST")
            if request.method != 'POST':
                raise cherrypy.HTTPError(405)