CVE-2026-63000: REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates

Summary The rexapiinstallpackageupdate API function (install addon) does not override requiresCsrfProtection(), which defaults to false in the base class rexapifunction. Any authenticated admin can therefore be tricked via a CSRF attack into silently triggering a package update from the REDAXO package server.

Details File: redaxo/src/core/lib/apifunction.php:277-280 php protected function requiresCsrfProtection() { return false; // DEFAULT — subclasses must opt in }

File: redaxo/src/addons/install/lib/api/apipackageupdate.php:8-39 php class rexapiinstallpackageupdate extends rexapifunction { public function execute() { if (!rex::getUser()?->isAdmin()) { throw new rexapiexception('You do not have the permission!'); } $addonkey = rexrequest('addonkey', 'string'); $fileId = rexrequest('file', 'int'); $installer = new rexinstallpackageupdate(); // ... downloads and installs $addonkey version $fileId from redaxo.org } // requiresCsrfProtection() NOT overridden — defaults to false }

For comparison, rexapiinstallpackageadd and rexapiinstallpackagedelete both correctly return true. Only rexapiinstallpackageupdate is missing this.

PoC html <!-- Attacker-controlled page --> <img src="https://victim-redaxo.example.com/index.php?page=install/packages&rex-api-call=installpackageupdate&addonkey=someaddon&file=42" /> When an authenticated admin visits this page, the request is automatically made with their session cookie, causing someaddon to be updated to version fileid=42.

Impact An attacker who can lure an admin to a malicious page can force-install specific addon versions. If combined with a supply-chain compromise of a package on redaxo.org, or by targeting a downgrade to a known-vulnerable version, this becomes a remote code execution vector. Even without supply-chain compromise, it can be used to disrupt the site by forcing unwanted updates.

Fix Add requiresCsrfProtection() to rexapiinstallpackageupdate: php protected function requiresCsrfProtection() { return true; }