CVE-2023-0642 (published 2023-02-02T12:15Z)

Cross-Site Request Forgery (CSRF) in GitHub repository squidex/squidex prior to 7.4.0.

CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-352
cwe_name: Cross-Site Request Forgery (CSRF)
description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
extended_description: When a web server is designed to receive a request from a client without any mechanism for verifying that it was intentionally sent, then it might be possible for an attacker to trick a client into making an unintentional request to the web server which will be treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc. and can result in exposure of data or unintended code execution.
         

Fix information:
repo_url: https://github.com/squidex/squidex
commit_details: repo_url: https://github.com/squidex/squidex
author: Sebastian
author_date: 2023-01-28 19:05:47+01:00
msg: Antiforgery for profile pages.
repository: repo_url: https://github.com/squidex/squidex
repo_name: Squidex/squidex
description: Headless CMS and Content Managment Hub
repo_language: C#
owner: squidex
file_changes: filename: AccountController.cs
change_type: ModificationType.MODIFY
diff: @@ -19,6 +19,7 @@ using Squidex.Web;
 
 namespace Squidex.Areas.IdentityServer.Controllers.Account;
 
+[AutoValidateAntiforgeryToken]
 public sealed class AccountController : IdentityServerController
 {
     private readonly IUserService userService;

programming_language: C#
filename: ProfileController.cs
change_type: ModificationType.MODIFY
diff: @@ -25,6 +25,7 @@ using Squidex.Web;
 namespace Squidex.Areas.IdentityServer.Controllers.Profile;
 
 [Authorize]
+[AutoValidateAntiforgeryToken]
 public sealed class ProfileController : IdentityServerController
 {
     private readonly IUserPictureStore userPictureStore;

programming_language: C#
filename: SetupController.cs
change_type: ModificationType.MODIFY
diff: @@ -21,6 +21,7 @@ using Squidex.Web;
 
 namespace Squidex.Areas.IdentityServer.Controllers.Setup;
 
+[AutoValidateAntiforgeryToken]
 public class SetupController : IdentityServerController
 {
     private readonly IAssetStore assetStore;

programming_language: C#
filename: Consent.cshtml
change_type: ModificationType.MODIFY
diff: @@ -12,6 +12,8 @@
 }
 
 <form asp-controller="Account" asp-action="Consent" asp-route-returnurl="@Model!.ReturnUrl" method="post">
+    @Html.AntiForgeryToken()
+
     <h2>@T.Get("users.consent.headline")</h2>
         
     <label for="consentToAutomatedEmails">

programming_language: HTML
filename: Login.cshtml
change_type: ModificationType.MODIFY
diff: @@ -31,6 +31,8 @@
     </div>
 
     <form asp-controller="Account" asp-action="External" asp-route-returnurl="@Model!.ReturnUrl" method="post">
+        @Html.AntiForgeryToken()
+
         @foreach (var provider in Model!.ExternalProviders)
         {
             var schema = provider.AuthenticationScheme.ToLowerInvariant();
@@ -60,6 +62,8 @@
             }
 
             <form asp-controller="Account" asp-action="Login" asp-route-returnurl="@Model!.ReturnUrl" method="post">
+                @Html.AntiForgeryToken()
+
                 <div class="form-group">
                     <input type="email" class="form-control" name="email" id="email" placeholder="@T.Get("users.login.emailPlaceholder")" />
                 </div>

programming_language: HTML
filename: Profile.cshtml
change_type: ModificationType.MODIFY
diff: @@ -38,6 +38,8 @@
     </div>
     <div class="col">
         <form id="pictureForm" class="profile-picture-form" asp-controller="Profile" asp-action="UploadPicture" method="post" enctype="multipart/form-data">
+            @Html.AntiForgeryToken()
+
             <span class="btn btn-secondary" id="pictureButton">
                 <span>@T.Get("users.profile.uploadPicture")</span>
 
@@ -48,6 +50,8 @@
 </div>
 
 <form class="profile-form profile-section" asp-controller="Profile" asp-action="UpdateProfile" method="post">
+    @Html.AntiForgeryToken()
+
     <div class="form-group">
         <label for="email">@T.Get("common.email")</label>
 
@@ -101,6 +105,8 @@
                         @if (Model!.ExternalLogins.Count > 1 || Model!.HasPassword)
                         {
                             <form asp-controller="Profile" asp-action="RemoveLogin" method="post">
+                                @Html.AntiForgeryToken()
+
                                 <input type="hidden" value="@login.LoginProvider" name="LoginProvider" />
                                 <input type="hidden" value="@login.ProviderKey" name="ProviderKey" />
 
@@ -115,6 +121,8 @@
         </table>
 
         <form asp-controller="Profile" asp-action="AddLogin" method="post">
+            @Html.AntiForgeryToken()
+
             @foreach (var provider in Model!.ExternalProviders.Where(x => Model!.ExternalLogins.All(y => x.AuthenticationScheme != y.LoginProvider)))
             {
                 var schema = provider.AuthenticationScheme.ToLowerInvariant();
@@ -134,9 +142,11 @@
     <div class="profile-section">
         <h2>@T.Get("users.profile.passwordTitle")</h2>
 
-       @if (Model!.HasPassword)
+        @if (Model!.HasPassword)
         {
             <form class="profile-form" asp-controller="Profile" asp-action="ChangePassword" method="post">
+                @Html.AntiForgeryToken()
+
                 <div class="form-group">
                     <label for="oldPassword">@T.Get("common.oldPassword")</label>
 
@@ -169,6 +179,8 @@
         else
         {
             <form class="profile-form" asp-controller="Profile" asp-action="SetPassword" method="post">
+                @Html.AntiForgeryToken()
+
                 <div class="form-group">
                     <label for="password">@T.Get("common.password")</label>
 
@@ -217,6 +229,8 @@
             <label for="generate">&nbsp;</label>
 
             <form class="profile-form" asp-controller="Profile" asp-action="GenerateClientSecret" method="post">
+                @Html.AntiForgeryToken()
+
                 <button type="submit" class="btn btn-success btn-block" id="generate">@T.Get("users.profile.generateClient")</button>
             </form>
         </div>
@@ -231,6 +245,8 @@
     <small class="form-text text-muted mt-2 mb-2">@T.Get("users.profile.propertiesHint")</small>
 
     <form class="profile-form" asp-controller="Profile" asp-action="UpdateProperties" method="post">
+        @Html.AntiForgeryToken()
+
         <div class="mb-2" id="properties">
             @for (var i = 0; i < Model!.Properties.Count; i++)
             {

programming_language: HTML
filename: Setup.cshtml
change_type: ModificationType.MODIFY
diff: @@ -160,6 +160,8 @@
         }
 
         <form class="profile-form" asp-controller="Setup" asp-action="Setup" method="post">
+            @Html.AntiForgeryToken()
+
             <div class="form-group">
                 <label for="email">@T.Get("common.email")</label>
 

programming_language: HTML
filename: content-list-cell.directive.ts
change_type: ModificationType.MODIFY
diff: @@ -36,7 +36,7 @@ export function getCellWidth(field: TableField, sizes: FieldSizes | undefined |
         case META_FIELDS.statusNext:
             return 240;
         case META_FIELDS.statusColor:
-            return 50;
+            return 80;
         case META_FIELDS.version:
             return 80;
         default:

programming_language: TypeScript
filename: content-list-field.component.html
change_type: ModificationType.MODIFY
diff: @@ -82,7 +82,7 @@
     </ng-container>
     <ng-container *ngSwitchCase="metaFields.statusColor">
         <ng-container *ngIf="content.newStatus; else singleStatus">
-            <span class="text-nowrap">
+            <span class="text-nowrap truncate">
                 <sqx-content-status
                     [status]="content.status"
                     [statusColor]="content.statusColor">

programming_language: HTML