CVE-2021-4005 (published 2021-12-04T12:15Z)

firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 4.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)

Weakness information:
cwe_id: CWE-352
cwe_name: Cross-Site Request Forgery (CSRF)
description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
extended_description: When a web server is designed to receive a request from a client without any mechanism for verifying that it was intentionally sent, then it might be possible for an attacker to trick a client into making an unintentional request to the web server which will be treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc. and can result in exposure of data or unintended code execution.
         

Fix information:
repo_url: https://github.com/firefly-iii/firefly-iii
commit_details: repo_url: https://github.com/firefly-iii/firefly-iii
author: James Cole
author_date: 2021-11-24 20:04:39+01:00
msg: Fix.
repository: repo_url: https://github.com/firefly-iii/firefly-iii
repo_name: firefly-iii/firefly-iii
description: Firefly III: a personal finances manager
repo_language: PHP
owner: firefly-iii
file_changes: filename: index.twig
change_type: ModificationType.MODIFY
diff: @@ -107,7 +107,7 @@
                     <div class="box box-default">
                         <div class="box-body">
                             <p class="text-info">{{ 'pref_two_factor_auth_help'|_ }}</p>
-                            {% if enabled2FA == false %}
+                            {% if enabled2FA == true %}
                                 <p class="text-info">
                                     {{ trans_choice('firefly.pref_two_factor_backup_code_count', mfaBackupCount) }}
                                 </p>
@@ -116,10 +116,11 @@
                                     <a class="btn btn-info" href="{{ route('profile.code') }}">
                                         <span class="fa fa-recycle"></span>
                                         {{ 'pref_two_factor_auth_reset_code'|_ }}</a>
-                                    <a class="btn btn-danger" href="{{ route('profile.delete-code') }}">
-                                        <span class="fa fa-trash"></span>
-                                        {{ 'pref_two_factor_auth_disable_2fa'|_ }}</a>
                                 </div>
+                                <form method="post" action="{{ route('profile.delete-code') }}">
+                                    <input type="hidden" name="_token" value="{{ csrf_token() }}" />
+                                    <input class="btn btn-danger" style="margin-top:20px;" type="submit" name="submit" value="{{ 'pref_two_factor_auth_disable_2fa'|_ }}" />
+                                </form>
                                 <form method="post" action="{{ route('profile.new-backup-codes') }}">
                                     <input type="hidden" name="_token" value="{{ csrf_token() }}" />
                                     <input class="btn btn-default" style="margin-top:20px;" type="submit" name="submit" value="{{ 'pref_two_factor_new_backup_codes'|_ }}" />

programming_language: HTML