Miggo Logo
Miggo Vulnerability Database
→
CVE-2021-28490

CVE-2021-28490: Cross-Site Request Forgery in OWASP CSRFGuard

8.8

CVSS Score
3.1

Basic Information

CVE ID
CVE-2021-28490
GHSA ID
GHSA-jx66-5ww9-m6q4
EPSS Score
0.36347%
CWE
CWE-352
Published
5/24/2022
Updated
1/27/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.owasp:csrfguardmaven<= 3.1.04.0.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from CSRF tokens being retrievable using only session tokens. The JavaScriptServlet is responsible for generating dynamic JavaScript containing CSRF tokens. In versions ≤3.1.0, it likely lacked proper origin/referer validation, allowing attackers to exfiltrate tokens via cross-origin requests. The patched version (4.0.0) introduced stricter CORS/referer checks, as implied by advisory notes requiring clients to respect CORS for proper protection. This aligns with the JavaScriptServlet's role in token injection and its configuration parameters (e.g., referer-pattern, domain-strict), which were insufficiently enforced in vulnerable versions.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

In OW*SP *SR**u*r* t*rou** *.*.*, *SR* **n o**ur ****us* t** *SR* *ooki* m*y ** r*tri*v** *y usin* only * s*ssion tok*n.

Reasoning

T** vuln*r**ility st*ms *rom *SR* tok*ns **in* r*tri*v**l* usin* only s*ssion tok*ns. T** `J*v*S*riptS*rvl*t` is r*sponsi*l* *or **n*r*tin* *yn*mi* J*v*S*ript *ont*inin* *SR* tok*ns. In v*rsions ≤*.*.*, it lik*ly l**k** prop*r ori*in/r***r*r v*li**ti