Executive brief
Kotti is a web content management system that allows administrators to assign user permissions to documents through a sharing interface. A Cross-Site Request Forgery (CSRF) vulnerability in the permission-management feature allows an attacker to trick an authenticated administrator into unintentionally changing document ownership and permissions by clicking a malicious link, resulting in unauthorized access escalation to sensitive documents.
Technical details
The vulnerability is a CSRF attack in the /admin-document/@@share endpoint of Kotti's local roles assignment functionality. The vulnerable component lacks anti-CSRF tokens (such as CSRF middleware or token validation) on the form that submits permission changes. An attacker can craft a malicious HTML form targeting an authenticated administrator, and if the administrator clicks the submit button, the form automatically sends a POST request to change document ownership and roles without the administrator's knowledge or consent. The attack requires user interaction (clicking a link or button) but no authentication from the attacker's perspective. Patches were released in Kotti 1.3.2 and 2.0.0b2.
Affected products
- Kotti Kotti before 1.3.2 and 2.x before 2.0.0b2
Timeline
- 2018-03-27: disclosed
- 2018-07-12: advisory
- 2018-07-12: patched: Fixed in versions 1.3.2 and 2.0.0b2