perfSONAR 4.4.5 Cross Site Request Forgery
Posted by deepcore on December 1, 2022 – 4:21 pm
A partial blind cross site request forgery (CSRF) vulnerability exists in perfSONAR versions 4.x through 4.4.5 within the /perfsonar-graphs/ test results page. Parameters and values can be injected/passed via the URL parameter, forcing the client to connect unknowingly in the background to other sites via transparent XMLHTTPRequests. This partial blind CSRF bypasses the built-in whitelisting function in perfSONAR.
Post a reply
You must be logged in to post a comment.