CSRF Protection Bypass in Vtenext Before 25.02

Executive Summary

This vulnerability is a cross-site request forgery (CSRF) protection bypass in vtenext versions before 25.02. The issue occurs because the csrf_check() function in include/utils/VteCsrf.php skips __csrf_token validation for non-POST requests. Attackers can exploit this by tricking a logged-in user into opening a crafted link that sends state-changing GET requests. Since handlers read these requests from $_REQUEST, the actions are performed as the authenticated user.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect the vtenext application for the presence of the affected file include/utils/VteCsrf.php and check if csrf_check() skips __csrf_token validation for non-POST requests. Review server logs for suspicious GET requests that perform state-changing actions.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to perform unauthorized actions on your behalf, such as changing account settings, modifying data, or triggering unintended transactions. Since the vulnerability allows GET requests to bypass CSRF protection, it increases the risk of such attacks through simple link clicks or malicious websites.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade vtenext to version 25.02 or later to address the CSRF bypass. Ensure all state-changing requests require POST and validate __csrf_token for all requests. Monitor for unusual GET requests that modify application state.

Useful 0 Not Useful 0