Administrator command execution via missing CSRF checks
Published Jul 20, 2023 · Updated Oct 24, 2024
Cross-Site Request Forgery in Cockpit CMS 2.5.2 allows remote attackers to execute arbitrary Administrator commands via crafted admin-portal requests. The admin API routes omit CSRF-token validation, so a malicious site can submit state-changing requests in a logged-in administrator's browser, including file-management actions. Exploitation requires an authenticated administrator to visit attacker-controlled content; demonstrated payloads can write and extract PHP files, resulting in server-side code execution.
Summary
What happened
Cross-Site Request Forgery in Cockpit CMS 2.5.2 allows remote attackers to execute arbitrary Administrator commands via crafted admin-portal requests. The admin API routes omit CSRF-token validation, so a malicious site can submit state-changing requests in a logged-in administrator's browser, including file-management actions. Exploitation requires an authenticated administrator to visit attacker-controlled content; demonstrated payloads can write and extract PHP files, resulting in server-side code execution.
The record
- CVE
- CVE-2023-37650
- Published
- Jul 20, 2023
- Updated
- Oct 24, 2024
- Vendor
- Unknown vendor
- Product
- Unknown product
- Classifications
- CWE-352, T1189
- Attack vector
- network
- Privileges
- authenticated
Timeline
How it unfolded
- Jun 30, 2023Exploitation reportedCSRF-to-RCE demonstration
- Jul 20, 2023CVE publishedPublication date reported by the CVE source.
- Oct 24, 2024Record updatedLatest update available in the CVE record.
Exploitability
Present is not the same as exploitable
Compare your product and version with the public record. A matching version still requires validation against your environment.
Is a vulnerable build present?
What conditions does exploitation require?
What is affected?
Affected products and versions are unavailable in this record.
Published CVSS scores
CVSS describes severity. EPSS estimates exploitation probability.
Attacks
What attackers are doing with it
Daily unique IPs observed by Shadowserver honeypots for known exploited vulnerabilities (KEVs). Missing observations do not establish an absence of attacks.
Public exploit references
- CSRF to RCE POCproof of concept · demonstrated
Labels summarize the accepted research assessment. They do not indicate a test against your environment.
Reported exploitation
- CSRF-to-RCE demonstrationreported exploitation
Technologies
Your stack
See the directory against your own environment.
Your stack
Check the software in your environment
Book a demo to see how Hinoki identifies affected software and validates exploitability in your environment.
Book a demo