Executive brief
Serendipity, a popular weblog engine, contains a security flaw that allows unauthorized individuals to delete blog comments. By tricking an authenticated administrator into clicking a malicious link, an attacker can force the system to delete any comment without the administrator's consent. This can lead to the loss of reader engagement data and disruption of site content.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in Serendipity through version 2.0.5 due to a failure to validate CSRF tokens in the comment.php script. Specifically, the serendipity_deleteComment function can be invoked via a crafted HTTP request without verifying the authenticity of the request origin. An attacker can exploit this by inducing an authenticated administrator to visit a malicious webpage, resulting in the deletion of arbitrary comments. The issue was addressed by implementing token verification for comment deletion actions.
Affected products
- s9y Serendipity through 2.0.5
Timeline
- 2017-01-12: disclosed: Issue reported on GitHub by Lee Sheldon Victor
- 2017-01-14: advisory: NVD publication date