CVE-2017-1000008 (published 2017-07-17T13:18Z)

Chyrp Lite version 2016.04 is vulnerable to a CSRF in the user settings function allowing attackers to hijack the authentication of logged in users to modify account information, including their password.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-352
cwe_name: Cross-Site Request Forgery (CSRF)
description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
extended_description: When a web server is designed to receive a request from a client without any mechanism for verifying that it was intentionally sent, then it might be possible for an attacker to trick a client into making an unintentional request to the web server which will be treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc. and can result in exposure of data or unintended code execution.
         

Fix information:
repo_url: https://github.com/xenocrat/chyrp-lite
commit_details: repo_url: https://github.com/xenocrat/chyrp-lite
author: Daniel Pimley
author_date: 2017-01-06 22:32:03+00:00
msg: MainController, Blog Themes: protect against CSRF

My thanks to @fleetcaptain for the report.
repository: repo_url: https://github.com/xenocrat/chyrp-lite
repo_name: xenocrat/chyrp-lite
description: An ultra-lightweight blogging engine, written in PHP.
repo_language: PHP
owner: xenocrat
file_changes: filename: Main.php
change_type: ModificationType.MODIFY
diff: @@ -620,6 +620,9 @@
             if (!empty($_POST)) {
                 $visitor = Visitor::current();
 
+                if (!isset($_POST['hash']) or $_POST['hash'] != token($_SERVER["REMOTE_ADDR"]))
+                    Flash::warning(__("Invalid security key."));
+
                 if (!empty($_POST['new_password1']))
                     if (empty($_POST['new_password2']) or $_POST['new_password1'] != $_POST['new_password2'])
                         Flash::warning(__("Passwords do not match."));

programming_language: PHP
filename: controls.twig
change_type: ModificationType.MODIFY
diff: @@ -18,6 +18,7 @@
 <div class="doaction">
 <button name="submit" type="submit" id="submit" tabindex="4">{{ "Update" | translate }}</button>
 </div>
+<input type="hidden" name="hash" value="{{ ip | token }}" id="hash">
 </form>
 </div>
 {% endblock %}

programming_language: HTML
filename: controls.twig
change_type: ModificationType.MODIFY
diff: @@ -18,6 +18,7 @@
 <div class="doaction">
 <button name="submit" type="submit" id="submit" tabindex="4">{{ "Update" | translate }}</button>
 </div>
+<input type="hidden" name="hash" value="{{ ip | token }}" id="hash">
 </form>
 </div>
 {% endblock %}

programming_language: HTML
filename: controls.twig
change_type: ModificationType.MODIFY
diff: @@ -18,6 +18,7 @@
 <div class="doaction">
 <button name="submit" type="submit" id="submit" tabindex="4">{{ "Update" | translate }}</button>
 </div>
+<input type="hidden" name="hash" value="{{ ip | token }}" id="hash">
 </form>
 </div>
 {% endblock %}

programming_language: HTML
filename: controls.twig
change_type: ModificationType.MODIFY
diff: @@ -18,6 +18,7 @@
 <div class="doaction">
 <button name="submit" type="submit" id="submit" tabindex="4">{{ "Update" | translate }}</button>
 </div>
+<input type="hidden" name="hash" value="{{ ip | token }}" id="hash">
 </form>
 </div>
 {% endblock %}

programming_language: HTML