CSRF in Masa CMS Address Management

Executive Summary

This vulnerability exists in Masa CMS versions 7.5.2 and earlier, specifically in the cUsers.updateAddress function. The function does not properly validate anti-CSRF tokens during user address management operations.

As a result, an attacker can trick a logged-in administrator into submitting a forged request that can add, modify, or delete user address records, including email addresses and phone numbers.

This allows the attacker to alter contact information, redirect organizational communications, and corrupt address data in the user directory.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can impact you by allowing an attacker to manipulate user address records without proper authorization.

• Alteration of contact information such as email addresses and phone numbers.
• Redirection of organizational communications to unintended recipients.
• Corruption of address data in the user directory, potentially causing operational disruptions.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability immediately, you should restrict access to the administrative backend.

Use browser isolation for administrative sessions to prevent attackers from exploiting forged requests.

Deploy filtering rules to block forged requests targeting the affected endpoint related to user address management.

Additionally, update Masa CMS to one of the fixed versions: 7.2.10, 7.3.15, 7.4.10, or 7.5.3 as soon as possible.

Useful 0 Not Useful 0