CVE-2020-18157 in MetInfo
Summary
by MITRE • 07/30/2021
Cross Site Request Forgery (CSRF) vulnerability in MetInfo 6.1.3 via a doaddsave action in admin/index.php.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/05/2021
The CVE-2020-18157 vulnerability represents a critical cross site request forgery flaw discovered in MetInfo content management system version 6.1.3. This vulnerability specifically affects the administrative interface through the doaddsave action parameter within the admin/index.php file, creating a significant security risk for organizations relying on this platform. The flaw allows authenticated attackers with administrative privileges to manipulate the system's functionality through forged requests, potentially leading to unauthorized changes in the application's configuration or data.
This CSRF vulnerability stems from the absence of proper anti-forgery tokens or validation mechanisms in the administrative endpoints of MetInfo. When administrators perform actions through the web interface, the application fails to verify that requests originate from legitimate administrative sessions rather than maliciously crafted requests. The doaddsave action in admin/index.php serves as the attack vector where an attacker can craft a malicious request that appears to come from a legitimate administrative session, exploiting the trust relationship between the user and the application.
The operational impact of this vulnerability extends beyond simple data manipulation as it provides attackers with the ability to perform administrative functions without proper authorization. An attacker could potentially add new users, modify existing accounts, alter system configurations, or even inject malicious content into the web application. The vulnerability is particularly concerning because it requires only administrative session access, meaning that if an attacker can obtain valid administrative credentials through other means such as credential theft or session hijacking, they can leverage this CSRF flaw to escalate their privileges or perform unauthorized administrative actions.
Security professionals should note that this vulnerability aligns with CWE-352, which specifically addresses Cross-Site Request Forgery weaknesses in software applications. The flaw demonstrates a classic lack of proper request validation and token implementation that violates fundamental web security principles. From an ATT&CK framework perspective, this vulnerability maps to technique T1078.004 for valid accounts and T1548.002 for abuse of cloud platforms, as it enables attackers to maintain persistent access and perform administrative operations within the compromised environment.
Organizations using MetInfo 6.1.3 should immediately implement mitigations including the deployment of anti-CSRF tokens throughout all administrative endpoints, particularly the doaddsave action in admin/index.php. The recommended approach involves implementing a unique, unpredictable token for each administrative session that must be validated on every administrative request. Additionally, organizations should ensure proper session management with secure cookie attributes, implement Content Security Policy headers, and consider rate limiting for administrative functions. Regular security audits and penetration testing should be conducted to identify similar vulnerabilities in other application components, as this flaw demonstrates a systemic weakness in the application's security architecture that may extend beyond the identified vector.