CVE-2021-3921 (Other, published 2021-11-13T09:15Z)
Description: value: firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
Severity: MEDIUM (CVSS v3 base score: 4.3)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/firefly-iii/firefly-iii
Files changed:
resources/views/v1/auth/login.twig
resources/views/v1/auth/passwords/email.twig
resources/views/v1/auth/passwords/reset.twig
resources/views/v1/auth/register.twig
resources/views/v1/partials/menu-sidebar.twig
resources/views/v1/profile/index.twig
resources/views/v2/auth/register.twig
resources/views/v2/partials/layout/navbar.twig
routes/web.php
Commit message: Fix huntr.dev logout issue.


Vulnerable code:
        <form action="{{ URL.to('/login') }}" method="post">
            <a href="{{ URL.to('/register') }}" class="text-center">{{ 'register_new_account'|_ }}</a><br>
            <a href="{{ URL.to('/password/reset') }}">{{ 'forgot_my_password'|_ }}</a>
            <form role="form" method="POST" action="{{ URL.to('/password/email') }}">
        <a href="{{ URL.to('/login') }}">{{ 'want_to_login'|_ }}</a><br>
        <a href="{{ URL.to('/login') }}">{{ 'want_to_login'|_ }}</a><br>
        <form id="register" method="POST" action="{{ URL.to('/register') }}">
        <a href="{{ URL.to('/login') }}">{{ 'want_to_login'|_ }}</a><br>
        <a href="{{ URL.to('/password/reset') }}">{{ 'forgot_my_password'|_ }}</a>
            <a href="{{ route('logout') }}">
                                        <li><a href="{{ route('logout') }}">{{ 'logout'|_ }}</a></li>
                                    <a href="{{ URL.to('/login') }}">{{ 'want_to_login'|_ }}</a>
                <a href="{{ route('logout') }}" class="dropdown-item">
        Route::any('logout', ['uses' => 'Auth\LoginController@logout', 'as' => 'logout']);

Fixed code:
        <form action="{{ route('login') }}" method="post">
            <a href="{{ route('register') }}" class="text-center">{{ 'register_new_account'|_ }}</a><br>
            <a href="{{ route('password.reset.request') }}">{{ 'forgot_my_password'|_ }}</a>
            <form role="form" method="POST" action="{{ route('password.email') }}">
        <a href="{{ route('login') }}">{{ 'want_to_login'|_ }}</a><br>
        <a href="{{ route('login') }}">{{ 'want_to_login'|_ }}</a><br>
        <form id="register" method="POST" action="{{ route('register') }}">
        <a href="{{ route('login') }}">{{ 'want_to_login'|_ }}</a><br>
        <a href="{{ route('password.reset.request') }}">{{ 'forgot_my_password'|_ }}</a>


        <form id="logout-form" action="{{ route('logout') }}" method="POST" style="display: none;">
            <input type="hidden" name="_token" value="{{ csrf_token() }}" />
        </form>
            <a href="{{ route('logout') }}" onclick="event.preventDefault();document.getElementById('logout-form').submit();">

                                        <form id="logout-form" action="{{ route('logout') }}" method="POST" style="display: none;">
                                            <input type="hidden" name="_token" value="{{ csrf_token() }}" />
                                        </form>

                                        <li><a href="{{ route('logout') }}" onclick="event.preventDefault();document.getElementById('logout-form').submit();">{{ 'logout'|_ }}</a></li>
                                    <a href="{{ route('login') }}">{{ 'want_to_login'|_ }}</a>
            <form id="logout-form" action="{{ route('logout') }}" method="POST" style="display: none;">
                <input type="hidden" name="_token" value="{{ csrf_token() }}" />
            </form>
                <a href="{{ route('logout') }}" class="dropdown-item" onclick="event.preventDefault();document.getElementById('logout-form').submit();">
        Route::post('logout', ['uses' => 'Auth\LoginController@logout', 'as' => 'logout']);