PT-2022-16822 · Unknown · Codeigniter4
CVSS v2.0
6.8
Medium
| Vector | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
CodeIgniter4 versions prior to 4.1.9
Description
A vulnerability in CodeIgniter4 might allow remote attackers to bypass the Cross-Site Request Forgery (CSRF) protection mechanism. This issue can be exploited when auto-routing is enabled or disabled, potentially leading to unauthorized actions. To mitigate this, users can check the request method in the controller method before processing or use HTTP verbs in routes instead of
$routes->add().Recommendations
For versions prior to 4.1.9, upgrade to version 4.1.9 or later.
As a temporary workaround, consider checking the request method in the controller method before processing, for example:
php
if (strtolower($this->request->getMethod()) !== 'post') {
return $this->response->setStatusCode(405)->setBody('Method Not Allowed');
}When auto-routing is disabled, either avoid using
$routes->add() and instead use HTTP verbs in routes, or check the request method in the controller method before processing.Exploit
Fix
CSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Codeigniter4