Executive brief
polaris-website is a web application for managing Roblox-related settings and preferences. A cross-site request forgery (CSRF) vulnerability allows an attacker to modify a user's settings if the user is logged in and visits an attacker-controlled website, without the user's knowledge or consent. While the attacker cannot read settings or verify whether their changes succeeded, unauthorized account modifications could disrupt service functionality.
Technical details
This is a classic CSRF vulnerability (CWE-352) in the polaris-website application stemming from missing request validation tokens. The vulnerability requires the user to be authenticated to the polaris-website service and to simultaneously visit an attacker-controlled domain; when both conditions are met, state-changing requests (settings updates) can be forged and executed in the user's browser session. The attack vector is network-based but requires user interaction (visiting a malicious site). The attacker can modify user settings but cannot read them or determine success. The vulnerability was patched in version 1.1.1 through implementation of the double-submit cookie pattern.
Affected products
- polaris-rbx polaris-website <1.1.1
Timeline
- 2020-08-05: disclosed
- 2020-08-05: patched: Fixed in version 1.1.1 via double-submit cookie pattern