CVE-2025-47410: Apache Geode: CSRF attacks through GET requests to the Management and Monitoring REST API that can execute gfsh commands on the target system

The vulnerability described is a Cross-Site Request Forgery (CSRF) in the Apache Geode Management and Monitoring REST API. The provided commit 570990909e6fd1e491f01471ad30ee3c2dbff72c directly addresses this issue. The patch modifies the ShellCommandsController.java file, specifically changing the @RequestMapping annotation for the command method. Previously, the endpoint /management/commands accepted both GET and POST requests. The patch removes RequestMethod.GET, restricting the endpoint to only RequestMethod.POST. This is a standard and effective mitigation for CSRF vulnerabilities, as it prevents attackers from executing commands through malicious URLs that trigger GET requests. Therefore, the command function within the ShellCommandsController is the vulnerable function, as it was the entry point for the CSRF attack.