CVE-2020-35239: CakePHP allows method override parameters to bypass CSRF checks
A vulnerability exists in CakePHP versions 4.0.x through 4.1.3. The CsrfProtectionMiddleware component allows method override parameters to bypass CSRF checks by changing the HTTP request method to an arbitrary string that is not in the list of request methods that CakePHP checks. Additionally, the route middleware does not verify that this overriden method (which can be an arbitrary string) is actually an HTTP method.
Other sources
CakePHP allows method override parameters to bypass CSRF checks
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/cakephp/cakephpto a version that resolves this vulnerability.Fixed in 4.1.4 - Upgrade
Upgrade
composer/cakephp/cakephpto a version that resolves this vulnerability.Fixed in 4.0.10
Event History
Frequently Asked Questions
What is the severity of CVE-2020-35239?
CVE-2020-35239 has been assigned a medium severity rating due to its potential to bypass CSRF protections.
How do I fix CVE-2020-35239?
To fix CVE-2020-35239, you should upgrade CakePHP to version 4.1.4 or later.
What versions of CakePHP are affected by CVE-2020-35239?
CVE-2020-35239 affects CakePHP versions 4.0.0 through 4.1.3.
What type of attacks can exploit CVE-2020-35239?
CVE-2020-35239 can be exploited to bypass CSRF protections, which may lead to unauthorized actions being executed on behalf of authenticated users.
Is there a workaround for CVE-2020-35239 if I cannot upgrade?
There is no official workaround for CVE-2020-35239, so upgrading to a patched version is recommended.