Executive Summary

This vulnerability is a critical Cross-Site Request Forgery (CSRF) issue in the FluxCP-based website template used by multiple rAthena/Ragnarok servers. The problem arises because state-changing POST endpoints accept requests authorized only by the session cookie, without using per-request anti-CSRF tokens or strong Origin/Referer validation. This means an attacker can trick a logged-in user into performing sensitive actions on the website without their knowledge or consent by luring them to a malicious page.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers to perform unauthorized actions on behalf of logged-in users without their intent. Since the affected endpoints change state and rely solely on session cookies for authorization, attackers can exploit this to manipulate user accounts, change settings, or perform other sensitive operations, potentially leading to account compromise or unauthorized changes.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, update the FluxCP-based website to include per-request anti-CSRF tokens or implement robust Origin/Referer validation on state-changing POST endpoints. Applying the fix from commit e3f130c will resolve the issue. Additionally, avoid allowing browser-initiated requests that rely solely on session cookies for authorization.

Useful 0 Not Useful 0