CVE-2017-2653: Input Validation
A number of unused delete routes are present in CloudForms before 5.7.2.1 which can be accessed via GET requests instead of just POST requests. This could allow an attacker to bypass the protectfromforgery XSRF protection causing the routes to be used. This attack would require additional cross-site scripting or similar attacks in order to execute.
Other sources
Martin Povolny of Red Hat reports:
Several routes in the CloudForms app contained actions that can be performed via GET request instead of POST request. This could result in a failure to check the protectfromforgery token, so these actions may be vulnerable to XSRF.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-2653?
CVE-2017-2653 is considered a moderate severity vulnerability.
How do I fix CVE-2017-2653?
To fix CVE-2017-2653, update to CloudForms version 5.7.2.1 or later.
What systems are affected by CVE-2017-2653?
CVE-2017-2653 affects CloudForms versions prior to 5.7.2.1 and specifically version 4.2.
What type of attack does CVE-2017-2653 enable?
CVE-2017-2653 enables attackers to potentially bypass XSRF protection on unused delete routes.
What are the implications of exploiting CVE-2017-2653?
Exploiting CVE-2017-2653 could allow unauthorized access to delete routes in CloudForms.