Executive Summary

This vulnerability in FreshRSS (versions 1.26.3 and below) is a double clickjacking issue where an attacker can bypass the double clickjacking protection implemented via a JavaScript confirmation dialog. By exploiting a flaw in how the application handles Ajax requests with a specific URL parameter, an attacker can trick an administrator into unknowingly clicking the 'Promote' button on another user's management page. This allows the attacker to escalate their privileges to admin and access other users' accounts. The attacker must know the specific FreshRSS instance URL to carry out the attack. The issue was fixed in version 1.27.0 by disabling confirmation buttons during Ajax requests and re-enabling them only through proper client-side validation. [1, 2]

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability can allow an attacker to escalate their privileges to administrator by tricking an admin into promoting them via a clickjacking attack. This means the attacker can gain full administrative access to the FreshRSS instance, including logging into other users' accounts, potentially leading to unauthorized data access, modification, or control over the system. [2]

Useful 0 Not Useful 0

Detection Guidance

You can detect this vulnerability by checking if your FreshRSS instance is running version 1.26.3 or below and if the user management pages respond to requests with the `&ajax=1` parameter by returning partial HTML without JavaScript confirmation dialogs. For example, you can use curl to test this behavior: `curl -i 'http://your-freshrss-instance/i/?c=user&a=details&username=someuser&ajax=1'` and verify if the response lacks the confirm() dialog JavaScript. Additionally, monitoring for suspicious admin page requests with the `&ajax=1` parameter or unusual double-click events on the Promote button could indicate exploitation attempts. [2]

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation is to upgrade FreshRSS to version 1.27.0 or later, where the vulnerability is fixed by disabling confirmation buttons during Ajax requests and enforcing client-side validation. If upgrading immediately is not possible, restrict access to the FreshRSS admin interface to trusted networks or users, and monitor for suspicious activity involving the Promote button. Applying stricter Content-Security-Policy headers and ensuring reauthentication (sudo mode) for sensitive actions can also help reduce risk until the update is applied. [1, 2]

Useful 0 Not Useful 0