Skip to content

CSRF Vulnerability in polaris-website

Moderate severity GitHub Reviewed Published Aug 2, 2020 in polaris-rbx/Polaris-React • Updated Jan 9, 2023

Package

npm polaris-website (npm)

Affected versions

< 1.1.1

Patched versions

1.1.1

Description

Impact

CSRF vulnerability:
In some very specific circumstances, an attacker would be able to update your settings.
Basically you would need to navigate to hackersite.com while logged into our panel. Then they could modify your settings. They couldn't check if it worked, nor could they read your settings.

Patches

As of v1.1.1 this has been patched by implementing the Double submit pattern using a cookie.

For more information

If you have any questions or comments about this advisory:

References

@Neztore Neztore published to polaris-rbx/Polaris-React Aug 2, 2020
Reviewed Aug 5, 2020
Published to the GitHub Advisory Database Aug 5, 2020
Last updated Jan 9, 2023

Severity

Moderate
6.8
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
High
Privileges required
None
User interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Weaknesses

CVE ID

No known CVE

GHSA ID

GHSA-whrh-9j4q-g7ph

Source code

Checking history
See something to contribute? Suggest improvements for this vulnerability.