CSRF in Semaphore UI Password Change

Executive Summary

This vulnerability is a Cross-Site Request Forgery (CSRF) flaw in Semaphore UI versions 2.18.20 and earlier. It allows an unauthenticated attacker to change a user's password, including administrator accounts, by tricking an authenticated user into visiting a malicious website. The endpoint lacks CSRF protection and does not require password confirmation.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Semaphore UI instance is running a version prior to 2.18.21. Use commands like 'curl -s https://your-semaphore-url | grep -i semaphore' or inspect the version in the web interface footer. Monitor network traffic for unauthorized password change requests to /api/users/{id}/password endpoints.

Useful 0 Not Useful 0

Impact Analysis

An attacker could take over user accounts, including administrator accounts, leading to unauthorized access to sensitive data and systems. The attacker needs to trick a logged-in user into visiting a malicious site, which then silently submits a password change request to the Semaphore instance.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and access control. Organizations using affected versions may face compliance violations and potential legal consequences.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Semaphore UI to version 2.18.21 or later. Ensure HTTPS is enforced and session cookies have Secure and SameSite=Lax attributes. Review user accounts for unauthorized password changes and revoke suspicious sessions.

Useful 0 Not Useful 0