CVE-2021-4268 (published 2022-12-21T19:15Z)

A vulnerability, which was classified as problematic, was found in phpRedisAdmin up to 1.17.3. This affects an unknown part. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 1.18.0 is able to address this issue. The name of the patch is b9039adbb264c81333328faa9575ecf8e0d2be94. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216471.

CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-352
cwe_name: Cross-Site Request Forgery (CSRF)
description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
extended_description: When a web server is designed to receive a request from a client without any mechanism for verifying that it was intentionally sent, then it might be possible for an attacker to trick a client into making an unintentional request to the web server which will be treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc. and can result in exposure of data or unintended code execution.
         

Fix information:
repo_url: https://github.com/erikdubbelboer/phpRedisAdmin
commit_details: repo_url: https://github.com/erikdubbelboer/phpRedisAdmin
author: Erik Dubbelboer
author_date: 2021-08-26 18:19:02+00:00
msg: Prevent Cross-Site Request Forgery
repository: repo_url: https://github.com/erikdubbelboer/phpRedisAdmin
repo_name: erikdubbelboer/phpRedisAdmin
description: Simple web interface to manage Redis databases.
repo_language: PHP
owner: erikdubbelboer
file_changes: filename: edit.php
change_type: ModificationType.MODIFY
diff: @@ -145,6 +145,7 @@ require 'includes/header.inc.php';
 ?>
 <h2><?php echo $edit ? 'Edit' : 'Add'?></h2>
 <form action="<?php echo format_html(getRelativePath('edit.php'))?>" method="post">
+<input type="hidden" name="csrf" value="<?php echo $csrfToken; ?>" />
 
 <p>
 <label for="type">Type:</label>

programming_language: PHP
filename: export.php
change_type: ModificationType.MODIFY
diff: @@ -187,6 +187,7 @@ require 'includes/header.inc.php';
 <h2>Export <?php echo isset($_GET['key']) ? format_html($_GET['key']) : ''?></h2>
 
 <form action="<?php echo format_html(getRelativePath('export.php'))?>" method="post">
+<input type="hidden" name="csrf" value="<?php echo $csrfToken; ?>" />
 
 <p>
 <label for="type">Type:</label>

programming_language: PHP
filename: import.php
change_type: ModificationType.MODIFY
diff: @@ -92,6 +92,7 @@ require 'includes/header.inc.php';
 ?>
 <h2>Import</h2>
 <form action="<?php echo format_html(getRelativePath('import.php'))?>" method="post">
+<input type="hidden" name="csrf" value="<?php echo $csrfToken; ?>" />
 
 <p>
 <label for="commands">Commands:<br>

programming_language: PHP
filename: common.inc.php
change_type: ModificationType.MODIFY
diff: @@ -4,6 +4,24 @@ require dirname(__FILE__) . '/../vendor/autoload.php';
 define('PHPREDIS_ADMIN_PATH', dirname(__DIR__));
 
 
+if (session_status() !== PHP_SESSION_DISABLED) {
+  session_start();
+
+  if (isset($_SESSION['phpredisadmin_csrf'])) {
+    $csrfToken = $_SESSION['phpredisadmin_csrf'];
+  } else {
+    $csrfToken = bin2hex(random_bytes(16));
+    $_SESSION['phpredisadmin_csrf'] = $csrfToken;
+  }
+} else {
+  $csrfToken = 'nosession';
+}
+
+if ($_SERVER['REQUEST_METHOD'] === 'POST') {
+  if ($_POST['csrf'] !== $csrfToken) {
+    die('bad csrf token');
+  }
+}
 
 
 // These includes are needed by each script.

programming_language: PHP
filename: login.php
change_type: ModificationType.MODIFY
diff: @@ -13,6 +13,7 @@ require 'includes/header.inc.php';
 <h1 class="logo">phpRedisAdmin</h1>
 
 <form class="form-signin" method="post" action="login.php">
+<input type="hidden" name="csrf" value="<?php echo $csrfToken; ?>" />
     <h2 class="form-signin-heading">Please log in</h2>
 
     <?php if (isset($_POST['username']) || isset($_POST['password'])): ?>

programming_language: PHP
filename: rename.php
change_type: ModificationType.MODIFY
diff: @@ -36,6 +36,7 @@ require 'includes/header.inc.php';
 ?>
 <h2>Edit Name of <?php echo format_html($_GET['key'])?></h2>
 <form action="<?php echo format_html(getRelativePath('rename.php'))?>" method="post">
+<input type="hidden" name="csrf" value="<?php echo $csrfToken; ?>" />
 
 <input type="hidden" name="old" value="<?php echo format_html($_GET['key'])?>">
 

programming_language: PHP
filename: ttl.php
change_type: ModificationType.MODIFY
diff: @@ -27,6 +27,7 @@ require 'includes/header.inc.php';
 ?>
 <h2>Edit TTL</h2>
 <form action="<?php echo format_html(getRelativePath('ttl.php'))?>" method="post">
+<input type="hidden" name="csrf" value="<?php echo $csrfToken; ?>" />
 
 <p>
 <label for="key">Key:</label>

programming_language: PHP