Miggo Logo

CVE-2022-32175: AdGuardHome vulnerable to Cross-Site Request Forgery

4.3

CVSS Score
3.1

Basic Information

EPSS Score
0.1558%
Published
10/11/2022
Updated
10/10/2023
KEV Status
No
Technology
TechnologyGo

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
github.com/AdguardTeam/AdGuardHomego>= 0.95, < 0.108.0-b.160.108.0-b.16

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from the handleFilteringSetRules function accepting text/plain content without proper CSRF protections. The pre-patch implementation directly read plain text rules from the request body (io.ReadAll) and split them, making it vulnerable to CSRF attacks via malicious links. The fix introduced JSON validation (filteringRulesReq struct) and Content-Type checks (via WriteTextPlainDeprecated), indicating the original text/plain processing was the vulnerability source. The function's direct connection to custom filtering rules modification and the security patch's focus on this endpoint confirm its role in the vulnerability.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

In ***u*r**om*, v*rsions v*.** t*rou** v*.***.*-*.** *r* vuln*r**l* to *ross-Sit* R*qu*st *or**ry (*SR*), in t** *ustom *ilt*rin* rul*s *un*tion*lity. *n *tt**k*r **n p*rsu*** *n *ut*oriz** us*r to *ollow * m*li*ious link, r*sultin* in **l*tin*/mo*i*

Reasoning

T** vuln*r**ility st*ms *rom t** `**n*l**ilt*rin*S*tRul*s` *un*tion ****ptin* t*xt/pl*in *ont*nt wit*out prop*r *SR* prot**tions. T** pr*-p*t** impl*m*nt*tion *ir**tly r*** pl*in t*xt rul*s *rom t** r*qu*st *o*y (`io.R****ll`) *n* split t**m, m*kin*