Xhelal Likaj

The issue affects applications using the fastify-csrf plugin with the "double submit" mechanism, particularly those deployed across multiple subdomains. To fully implement protection, users of the module must supply a `userInfo` when generating the CSRF token, which is necessary for applications hosted on different subdomains.

The issue is related to a non-constant-time comparison of CSRF tokens in the UIDL request handler. This allows an attacker to guess a security token via a timing attack.

The issue is related to a non-constant-time comparison of CSRF tokens in the UIDL request handler, which allows an attacker to guess a security token via a timing attack.

The issue is related to a non-constant-time comparison of CSRF tokens in the endpoint request handler. This allows an attacker to guess a security token for Fusion endpoints via a timing attack.

Name of the Vulnerable Software and Affected Versions: Vert.x-Web framework versions 4.0 milestone 1 through 4.0 milestone 4 Description: The issue arises from incorrect CSRF verification. Instead of comparing the CSRF token in the request with the CSRF token in the cookie, the framework compares the CSRF token in the cookie against a CSRF token stored in the session. This means an attacker does not need to provide a CSRF token in the request, as the verification will always succeed due to the automatic sending of cookies by the browser, leading to a successful CSRF attack. Recommendations: For versions 4.0 milestone 1 through 4.0 milestone 4, consider disabling the CSRF verification mechanism until a patch is available, or apply a custom fix to correctly compare the CSRF token in the request with the one in the cookie. Restrict access to sensitive operations that rely on CSRF protection to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: CakePHP versions 4.0.x through 4.1.3 Description: A vulnerability exists in the CsrfProtectionMiddleware component, allowing method override parameters to bypass CSRF checks by changing the HTTP request method to an arbitrary string that is not in the list of request methods that CakePHP checks. The route middleware does not verify that this overridden method, which can be an arbitrary string, is actually an HTTP method. Recommendations: For CakePHP versions 4.0.x through 4.1.3, consider disabling the CsrfProtectionMiddleware component or restricting its use until a patch is available. As a temporary workaround, restrict access to the route middleware to minimize the risk of exploitation. Avoid using method override parameters in HTTP requests to the affected CakePHP versions until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.