Malcolm Kiosk Flask CSRF Lets Attackers Wipe Data

Executive Summary

This vulnerability is in the Malcolm kiosk Flask application. It has an endpoint POST /script_call/<script> that requires no authentication and allows wildcard CORS. An attacker can trick a user's browser into sending requests to this endpoint via CSRF, executing arbitrary management commands like deleting forensic logs or stopping monitoring.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized POST requests to /script_call/<script> endpoints in Malcolm kiosk logs. Monitor network traffic for suspicious CSRF attempts targeting control.py commands like --wipe or --stop. Inspect browser console logs for wildcard CORS misconfigurations.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to delete all captured network traffic and forensic logs permanently using control.py --wipe. They could also stop monitoring with control.py --stop, disabling security visibility. This could blind security teams to ongoing or past intrusions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA by allowing deletion of forensic logs and disabling monitoring. GDPR requires data breach logs for 72 hours; HIPAA mandates audit log retention. Loss of logs or monitoring could result in regulatory penalties or fines.

Useful 0 Not Useful 0

Mitigation Strategies

Disable the exposed /script_call/ endpoint immediately. Remove wildcard CORS settings and implement strict authentication for all management endpoints. Block external access to the Flask application if possible.

Useful 0 Not Useful 0