CVE-2017-9365 (published 2017-06-02T05:29Z)

CSRF exists in BigTree CMS through 4.2.18 with the force parameter to /admin/pages/revisions.php - for example: /admin/pages/revisions/1/?force=false. A page with id=1 can be unlocked.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-352
cwe_name: Cross-Site Request Forgery (CSRF)
description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
extended_description: When a web server is designed to receive a request from a client without any mechanism for verifying that it was intentionally sent, then it might be possible for an attacker to trick a client into making an unintentional request to the web server which will be treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc. and can result in exposure of data or unintended code execution.
         

Fix information:
repo_url: https://github.com/bigtreecms/BigTree-CMS
commit_details: repo_url: https://github.com/bigtreecms/BigTree-CMS
author: Tim Buckingham
author_date: 2017-05-25 16:40:42-04:00
msg: Remove the possibility of a CSRF attack unlocking a page / module entry.
https://github.com/bigtreecms/BigTree-CMS/issues/281
repository: repo_url: https://github.com/bigtreecms/BigTree-CMS
repo_name: bigtreecms/BigTree-CMS
repo_language: PHP
owner: bigtreecms
file_changes: filename: _locked.php
change_type: ModificationType.MODIFY
diff: @@ -13,7 +13,7 @@
 		</p>
 	</section>
 	<footer>
-		<a href="?force=true<?=$view_data?>" class="button blue">Unlock</a>
+		<a href="?force=true<?=$view_data?><? $admin->drawCSRFTokenGET(); ?>" class="button blue">Unlock</a>
 		&nbsp;
 		<a href="javascript:history.go(-1);" class="button white">Cancel</a>
 	</footer>

programming_language: PHP
filename: edit.php
change_type: ModificationType.MODIFY
diff: @@ -1,6 +1,12 @@
 <?
 	// Check for a page lock
-	$force = isset($_GET["force"]) ? true : false;
+	if (!empty($_GET["force"])) {
+		$admin->verifyCSRFToken();
+		$force = true;
+	} else {
+		$force = false;
+	}
+	
 	$admin->lockCheck($bigtree["form"]["table"],$bigtree["edit_id"],"admin/auto-modules/forms/_locked.php",$force);
 	
 	$pending_entry = BigTreeAutoModule::getPendingItem($bigtree["form"]["table"],$bigtree["edit_id"]);

programming_language: PHP
filename: _locked.php
change_type: ModificationType.MODIFY
diff: @@ -12,6 +12,6 @@
 	<footer>
 		<a href="javascript:history.go(-1);" class="button white">Cancel</a>
 		&nbsp;
-		<a href="?force=true" class="button blue">Unlock</a>
+		<a href="?force=true<? $admin->drawCSRFTokenGET() ?>" class="button blue">Unlock</a>
 	</footer>
 </div>
\ No newline at end of file

programming_language: PHP
filename: edit.php
change_type: ModificationType.MODIFY
diff: @@ -6,7 +6,13 @@
 	include BigTree::path("admin/modules/pages/_properties.php");
 	
 	// Check for a page lock
-	$force = isset($_GET["force"]) ? $_GET["force"] : false;
+	if (!empty($_GET["force"])) {
+		$admin->verifyCSRFToken();
+		$force = true;
+	} else {
+		$force = false;
+	}
+	
 	$admin->lockCheck("bigtree_pages",$page["id"],"admin/modules/pages/_locked.php",$force);
 	
 	// Grab template information

programming_language: PHP
filename: revisions.php
change_type: ModificationType.MODIFY
diff: @@ -32,7 +32,13 @@
 	}
 	
 	// Check for a page lock
-	$force = isset($_GET["force"]) ? $_GET["force"] : false;
+	if (!empty($_GET["force"])) {
+		$admin->verifyCSRFToken();
+		$force = true;
+	} else {
+		$force = false;
+	}
+
 	$lock_id = $admin->lockCheck("bigtree_pages",$page["id"],"admin/modules/pages/_locked.php",$force);
 	
 	// See if there's a draft copy.

programming_language: PHP