Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability exists in three controllers: ActivityController, CustomerController, and ProjectController. Each of these controllers had a method named createDefaultTeamAction that was mapped to a GET route (/{id}/create_team). These methods performed sensitive actions, such as creating teams and assigning permissions. Since GET requests can be initiated by simply visiting a URL, they are susceptible to Cross-Site Request Forgery (CSRF) attacks. An attacker could craft a malicious link and trick a logged-in administrator into clicking it, thereby executing the sensitive actions without the administrator's consent.
The patch addresses this vulnerability by removing the createDefaultTeamAction methods and their corresponding GET routes from the controllers. Instead, new methods (postDefaultTeamAction) were added to the API controllers (src/API/ActivityController.php, src/API/CustomerController.php, src/API/ProjectController.php). These new methods are mapped to POST routes (/{id}/team). Using POST requests for state-changing operations is the standard mitigation for CSRF, as they are not triggered by simply visiting a URL.
App\Controller\ActivityController::createDefaultTeamActionsrc/Controller/ActivityController.php
App\Controller\CustomerController::createDefaultTeamActionsrc/Controller/CustomerController.php
App\Controller\ProjectController::createDefaultTeamActionsrc/Controller/ProjectController.php
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| kimai/kimai | composer | <= 2.57.0 | 2.58.0 |