Executive brief
Avenwu Whistle is a JavaScript HTTP proxy tool commonly used for development and debugging. A cross-site request forgery (CSRF) vulnerability in versions 2.9.90 and earlier allows an attacker to trick users into performing unauthorized API calls, which can lead to arbitrary code execution on the victim's machine.
Technical details
This CSRF vulnerability (CWE-352) exists in Avenwu Whistle v2.9.90 and earlier due to improper origin validation (origin reflection). An unauthenticated attacker can craft a malicious webpage that, when visited by a Whistle user, triggers unwanted API requests to the Whistle proxy with the victim's credentials. The attack requires user interaction (victim must visit a malicious site) but no authentication, and operates over the network. Successful exploitation allows the attacker to execute arbitrary code on the victim's machine. The fix involves refining the --allowOrigin parameter to properly validate request origins.
Affected products
- Avenwu Whistle 2.9.90 and earlier
Timeline
- 2024-12-10: disclosed
- 2024-12-10: patched: Fix committed at d1b8ca2 to refine --allowOrigin parameter