Cross-Site Request Forgery in REDAXO CMS

Executive Summary

REDAXO before 5.21.3 has a CSRF token bypass flaw in the backend user administration page. The CSRF token check only runs when the save parameter is set, but the update path triggered by FUNC_UPDATE does not require it. Attackers can trick a logged-in user with users[] permission into clicking a malicious link to gain admin rights, deactivate accounts, or lock out the sole administrator.

This vulnerability allows privilege escalation through a simple GET request without proper token validation.

Useful 0 Not Useful 0

Detection Guidance

Check the REDAXO version installed on your system. If it is below 5.21.3, the system is vulnerable. Run: grep -r 'REDAXO' /path/to/redaxo/installation or check the version in the admin panel.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to gain full administrator access, deactivate user accounts, or lock out the only administrator, leading to complete system compromise. It requires a logged-in user with users[] permission to click a malicious link.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, violating GDPR (data protection) and HIPAA (health information privacy) requirements for access control and integrity. Full system compromise may result in non-compliance with these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade REDAXO to version 5.21.3 or later immediately. Remove unnecessary user permissions and monitor for suspicious account changes.

Useful 0 Not Useful 0