REDAXO before 5.21.3 CSRF Token Bypass via users/users Privilege Escalation

Summary

REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the backend user administration page (users/users) because the CSRF token check only runs when the save parameter is set, while the update path triggered by FUNC_UPDATE does not require it. Attackers can lure a logged-in backend user with the users[] permission to a crafted GET link to grant administrator rights, deactivate accounts, or lock out the sole administrator.

Remediation

1. Inventory every redaxo core deployment, including staging.
2. Upgrade redaxo core to 5.21.3.
3. Confirm the running version after the upgrade.

References

• Advisoryhttps://github.com/redaxo/core/security/advisories/GHSA-mrrj-4f5x-j958
• Advisoryhttps://www.vulncheck.com/advisories/redaxo-before-5.21.3-csrf-token-bypass-via-users-users-privilege-escalation