Miggo Logo
Miggo Vulnerability Database
→
CVE-2021-3728

CVE-2021-3728: firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)

6.5

CVSS Score
3.0

Basic Information

CVE ID
CVE-2021-3728
GHSA ID
GHSA-xp5q-77mh-6hm2
EPSS Score
0.30404%
CWE
CWE-352
Published
8/25/2021
Updated
7/6/2023
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
grumpydictator/firefly-iiicomposer< 5.6.05.6.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from two key points: 1) The JavaScript function deleteBudgetLimit() originally triggered destructive actions via GET requests without CSRF tokens, as evidenced by the patch adding e.preventDefault() and proper POST handling. 2) The route definition in web.php initially allowed GET requests for deletion, which the patch changed to POST. CSRF vulnerabilities typically occur when state-changing endpoints don't enforce proper HTTP methods and CSRF protections.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*ir**ly-iii is vuln*r**l* to *ross-Sit* R*qu*st *or**ry (*SR*)

Reasoning

T** vuln*r**ility st*ms *rom two k*y points: *) T** J*v*S*ript *un*tion `**l*t**u***tLimit()` ori*in*lly tri***r** **stru*tiv* **tions vi* **T r*qu*sts wit*out *SR* tok*ns, *s *vi**n*** *y t** p*t** ***in* `*.pr*v*nt****ult()` *n* prop*r POST **n*lin