Executive brief
Serendipity, a popular weblog engine, contains a security flaw that could allow an attacker to trick an administrator into performing unintended actions. Specifically, an attacker can force the installation of unauthorized event or sidebar plugins if a logged-in administrator visits a malicious website. This could lead to unauthorized changes to the website's functionality or the introduction of malicious code through rogue plugins.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in Serendipity through version 2.0.5 due to insufficient validation of request tokens when installing plugins. An attacker can craft a malicious web page that, when visited by an authenticated administrator, triggers a background request to the Serendipity administrative interface to install a specific event or sidebar plugin. This occurs because the application does not properly verify that the request was intentionally initiated by the user. Successful exploitation allows an attacker to modify the blog's behavior or potentially achieve further compromise by installing plugins with malicious capabilities. The issue was addressed in subsequent updates by implementing CSRF token checks.
Affected products
- s9y Serendipity up to and including 2.0.5
Timeline
- 2017-01-12: disclosed: Issue reported on GitHub repository
- 2017-01-14: advisory: NVD published CVE-2017-5476