Critical · published October 2, 2023
🚨 A simple change of a token value could let an attacker run rampant on your platform as an admin! 🔥 Think of it like a restaurant where anyone can walk in and change their reservation name to 'CEO' without any verification — suddenly, they have access to the VIP room and the whole menu! This Cross-Site Request Forgery (CSRF) vulnerability allows an unprivileged remote user to execute actions as an administrator, which means they could create, delete, and modify users without breaking a sweat. If exploited, it could lead to absolute chaos, potentially compromising user data and permissions across the entire platform!
Think of it like a restaurant where anyone can walk in and change their reservation name to 'CEO' without any verification — suddenly, they have access to the VIP room and the whole menu! CVE-2023-4659 allows attackers to perform any action by simply changing the token to 'admin', or even bypassing authentication altogether for POST, GET, and DELETE requests. This means that normal users can act with elevated privileges without any valid token!
This Cross-Site Request Forgery (CSRF) vulnerability allows an unprivileged remote user to execute actions as an administrator, which means they could create, delete, and modify users without breaking a sweat. If exploited, it could lead to absolute chaos, potentially compromising user data and permissions across the entire platform! To secure your system, implement anti-CSRF tokens and ensure that all requests require proper authentication checks. Additionally, patch your application to the latest version as soon as possible to close this terrifying loophole! You've got this! With these steps, you'll have your platform locked down in no time. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| free5gc/webconsole | all versions | — |