GHSA-m8r3-22v6-g877: CSRF

Summary The rexapiinstallpackageupdate API function (install addon) does not override requiresCsrfProtection(), which defaults to false in the base class rexapifunction. Any authenticated admin can therefore be tricked via a CSRF attack into silently triggering a package update from the REDAXO package server.

Details File: redaxo/src/core/lib/apifunction.php:277-280 php protected function requiresCsrfProtection() { return false; // DEFAULT — subclasses must opt in }

File: redaxo/src/addons/install/lib/api/apipackageupdate.php:8-39 php class rexapiinstallpackageupdate extends rexapifunction { public function execute() { if (!rex::getUser()?->isAdmin()) { throw new rexapiexception('You do not have the permission!'); } $addonkey = rexrequest('addonkey', 'string'); $fileId = rexrequest('file', 'int'); $installer = new rexinstallpackageupdate(); // ... downloads and installs $addonkey version $fileId from redaxo.org } // requiresCsrfProtection() NOT overridden — defaults to false }

For comparison, rexapiinstallpackageadd and rexapiinstallpackagedelete both correctly return true. Only rexapiinstallpackageupdate is missing this.

PoC html <!-- Attacker-controlled page --> <img src="https://victim-redaxo.example.com/index.php?page=install/packages&rex-api-call=installpackageupdate&addonkey=someaddon&file=42" /> When an authenticated admin visits this page, the request is automatically made with their session cookie, causing someaddon to be updated to version fileid=42.

Impact An attacker who can lure an admin to a malicious page can force-install specific addon versions. If combined with a supply-chain compromise of a package on redaxo.org, or by targeting a downgrade to a known-vulnerable version, this becomes a remote code execution vector. Even without supply-chain compromise, it can be used to disrupt the site by forcing unwanted updates.

Fix Add requiresCsrfProtection() to rexapiinstallpackageupdate: php protected function requiresCsrfProtection() { return true; }