Cross-Site Request Forgery in REDAXO CMS

Executive Summary

This is a Cross-Site Request Forgery (CSRF) vulnerability in REDAXO versions before 5.21.3. It affects the structure/history plugin and allows attackers to delete article history or roll back content by tricking logged-in backend users into visiting a malicious page. The attack works via unvalidated GET requests using parameters like func=clearall or rex_history_function=snap.

Useful 0 Not Useful 0

Detection Guidance

Check REDAXO version with: grep -r "REDAXO_VERSION" /path/to/redaxo/core or check the admin panel footer. Inspect network traffic for GET requests to URLs containing func=clearall or rex_history_function=snap. Review server logs for suspicious deletion or rollback actions in article history.

Useful 0 Not Useful 0

Impact Analysis

If exploited, attackers can permanently delete all article snapshots or revert articles to earlier versions. This could lead to loss of content history, unintended content changes, and disruption of workflows. The attack requires tricking a logged-in user to click a malicious link while they are authenticated in the backend.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade REDAXO to version 5.21.3 or later immediately. Disable the article history plugin if not needed. Implement CSRF tokens for all sensitive actions. Monitor for unauthorized history deletions or content rollbacks.

Useful 0 Not Useful 0