CVE-2020-10771: CSRF

A flaw was found in infinispan-server-rest version 10, where it is possible to perform various actions that could have side effects using GET requests. This flaw allows an attacker to perform a Cross-site request forgery (CSRF) attack.

We shouldn't be using GET request to perform these actions:

GET /rest/v2/server?action=stop GET /rest/v2/cluster?action=stop GET /rest/v2/tasks/myTask?action=exec¶m.p1=v1¶m.p2=v2 GET /rest/v2/cache-managers/{cacheManagerName}/x-site/backups/{siteName}?action=cancel-push-state GET /rest/v2/cache-managers/{cacheManagerName}/x-site/backups/{siteName}?action=start-push-state GET /rest/v2/cache-managers/{cacheManagerName}/x-site/backups/{siteName}?action=bring-online GET /rest/v2/cache-managers/{cacheManagerName}/x-site/backups/{siteName}?action=take-offline GET /rest/v2/counters/{counterName}?action=compareAndSet&expect={expect}&update={update} GET /rest/v2/counters/{counterName}?action=compareAndSwap&expect={expect}&update={update} GET /rest/v2/counters/{counterName}?action=decrement GET /rest/v2/counters/{counterName}?action=add&delta={delta} GET /rest/v2/counters/{counterName}?action=increment GET /rest/v2/counters/{counterName}?action=reset GET /v2/caches/{cacheName}/x-site/backups/{siteName}?action=cancel-receive-state

https://issues.redhat.com/browse/JDG-3625

— Red Hat