Executive brief
IRIS is a collaborative web platform used by incident responders to manage and share technical details during security investigations. A vulnerability in the platform allows attackers to trick logged-in users into performing unintended actions, such as rotating their API security tokens or being forcibly logged out. This could disrupt ongoing investigations or break automated integrations that rely on the affected API tokens.
Technical details
The IRIS web application is vulnerable to Cross-Site Request Forgery (CSRF) because it incorrectly trusts HTTP GET methods for state-changing operations, such as API token renewal and user logout. While the application implements CSRF tokens for POST requests, these protections are bypassed when the server accepts parameters via GET. An unauthenticated remote attacker can exploit this by luring an authenticated user to a malicious website or by embedding malicious tags (e.g., <img> tags) within the IRIS application itself. Successful exploitation can lead to unauthorized API key rotation, which invalidates existing tokens and disrupts integrated services, or forced session termination. The issue is addressed in version 2.4.28 by ensuring state changes require POST requests and enforcing proper method validation.
Affected products
- DFIR-IRIS IRIS <= 2.4.27
Timeline
- 2026-01-28: other: Vulnerability identified in version 2.4.26
- 2026-01-30: other: Initial vendor contact
- 2026-04-27: patched: Version 2.4.28 tagged with fix
- 2026-05-19: disclosed: Public disclosure via oss-security and SBA Research
- 2026-06-04: advisory: NVD advisory published