CVE-2018-1000053 (published 2018-02-09T23:29Z)

LimeSurvey version 3.0.0-beta.3+17110 contains a Cross ite Request Forgery (CSRF) vulnerability in Theme Uninstallation that can result in CSRF causing LimeSurvey admins to delete all their themes, rendering the website unusable. This attack appear to be exploitable via Simple HTML markup can be used to send a GET request to the affected endpoint.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-352
cwe_name: Cross-Site Request Forgery (CSRF)
description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
extended_description: When a web server is designed to receive a request from a client without any mechanism for verifying that it was intentionally sent, then it might be possible for an attacker to trick a client into making an unintentional request to the web server which will be treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc. and can result in exposure of data or unintended code execution.
         

Fix information:
repo_url: https://github.com/LimeSurvey/LimeSurvey
commit_details: repo_url: https://github.com/LimeSurvey/LimeSurvey
author: LouisGac
author_date: 2018-01-24 15:26:04+01:00
msg: Fixed issue: no CRSF check for uninstall theme, reported by MUSTAFA HASAN
repository: repo_url: https://github.com/LimeSurvey/LimeSurvey
repo_name: LimeSurvey/LimeSurvey
description: The most popular FOSS online survey tool on the web.
repo_language: JavaScript
owner: LimeSurvey
file_changes: filename: themeoptions.php
change_type: ModificationType.MODIFY
diff: @@ -233,8 +233,9 @@ class themeoptions  extends Survey_Common_Action
 
     }
 
-    public function uninstall($templatename)
+    public function uninstall()
     {
+        $templatename = Yii::app()->request->getPost('templatename');
         if (Permission::model()->hasGlobalPermission('templates', 'update')) {
             if (!Template::hasInheritance($templatename)) {
                 TemplateConfiguration::uninstall($templatename);
@@ -262,12 +263,12 @@ class themeoptions  extends Survey_Common_Action
 
     public function getPreviewTag()
     {
-        $templatename = Yii::app()->request->getPost('templatename');        
+        $templatename = Yii::app()->request->getPost('templatename');
         $oTemplate = TemplateConfiguration::getInstanceFromTemplateName($templatename);
         $previewTag = $oTemplate->getPreview();
         return Yii::app()->getController()->renderPartial(
             '/admin/super/_renderJson',
-            ['data' => ['image' =>  $previewTag]], 
+            ['data' => ['image' =>  $previewTag]],
             false,
             false
         );

programming_language: PHP
filename: TemplateConfiguration.php
change_type: ModificationType.MODIFY
diff: @@ -511,7 +511,7 @@ class TemplateConfiguration extends TemplateConfig
             $sOptionUrl    = Yii::app()->getController()->createUrl('admin/themeoptions/sa/update', array("id"=>$this->id));
         }
 
-        $sUninstallUrl = Yii::app()->getController()->createUrl('admin/themeoptions/sa/uninstall/', array("templatename"=>$this->template_name));
+        $sUninstallUrl = Yii::app()->getController()->createUrl('admin/themeoptions/sa/uninstall/');
 
         $sEditorLink = "<a
             id='template_editor_link_".$this->template_name."'
@@ -538,7 +538,9 @@ class TemplateConfiguration extends TemplateConfig
 
         $sUninstallLink = '<a
             id="remove_fromdb_link_'.$this->template_name.'"
-            data-href="'.$sUninstallUrl.'"
+            data-ajax-url="'.$sUninstallUrl.'"
+            data-post=\'{ "templatename": "'.$this->template_name.'" }\'
+            data-gridid = "yw0"
             data-target="#confirmation-modal"
             data-toggle="modal"
             data-message="'.gT('This will delete all the specific configurations of this theme.').'<br>'.gT('Do you want to continue?').'"

programming_language: PHP