CSRF in Roskus Prospero Flow CRM Before 5.15.11

Executive Summary

This is a Cross-Site Request Forgery (CSRF) vulnerability in Roskus Prospero Flow CRM before version 5.15.11. It allows an unauthenticated attacker to confirm any order by tricking an authenticated user into clicking a malicious link. The vulnerability exists because the OrderConfirmController uses a GET request for a state-changing action, which Laravel's CSRF protection does not cover. Session cookies with SameSite=Lax are included in cross-site navigation, enabling the attack with a single click.

Useful 0 Not Useful 0

Detection Guidance

Check for GET requests to /order/confirm/{order_number} that modify order status without CSRF protection. Inspect server logs for unusual GET requests confirming orders. Verify Laravel route definitions for GET methods handling state changes.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to confirm orders without user consent, potentially causing financial or operational disruptions. Since order numbers are sequential, an attacker could automate attacks to confirm all pending orders, leading to unauthorized transactions or service changes.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Roskus Prospero Flow CRM to version 5.15.11 or later. Change GET /order/confirm/{order_number} to POST and ensure CSRF middleware is enforced. Set SameSite cookie attribute to Strict to prevent cross-site inclusion.

Useful 0 Not Useful 0