GHSA-423v-8x3h-gxr3: REDAXO before 5.21.5 CSRF via Safe Mode Toggle Parameter
REDAXO before 5.21.5 contains a cross-site request forgery vulnerability because the backend processes the safemode GET parameter in index.php without validating a CSRF token. Attackers can lure a logged-in administrator into opening a crafted link to disable global safe mode, writing safemode: false to config.yml, or enable session safe mode, disabling backend addons.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
REDAXOto a version that resolves this vulnerability.Fixed in 5.21.5
Event History
Frequently Asked Questions
Who is exposed to this issue?
REDAXO installations before 5.21.5 are exposed when an administrator is logged in to the backend and can be induced to open an attacker-crafted link. The attack is network-delivered and does not require the attacker to authenticate.
What changes can an attacker trigger?
A crafted request can disable global safe mode, causing safe_mode: false to be written to config.yml. It can also enable session safe mode, which disables backend addons for the affected session.
Is user interaction required?
Yes. Exploitation requires a logged-in administrator to open the crafted link; the vulnerable backend action is performed through the safemode GET parameter without CSRF-token validation.