CVE-2020-13460
📋 TL;DR
Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Tufin SecureTrack allow attackers to trick authenticated users into performing unintended actions. This affects all versions prior to R20-2 GA, potentially compromising network security configurations.
💻 Affected Systems
- Tufin SecureTrack
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could modify network security policies, create backdoors, disable security controls, or gain administrative access to the SecureTrack platform.
Likely Case
Attackers could perform unauthorized configuration changes, create new user accounts with elevated privileges, or exfiltrate sensitive network topology data.
If Mitigated
With proper CSRF protections and network segmentation, impact is limited to unauthorized actions within the authenticated user's permission scope.
🎯 Exploit Status
CSRF attacks require user interaction but are relatively simple to execute once the vulnerable endpoints are identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: R20-2 GA and later
Vendor Advisory: https://support.tufin.com/hc/en-us/articles/360050574492
Restart Required: Yes
Instructions:
1. Backup current configuration. 2. Download R20-2 GA or later from Tufin support portal. 3. Apply the update following Tufin's upgrade documentation. 4. Restart SecureTrack services. 5. Verify functionality.
🔧 Temporary Workarounds
Implement CSRF Tokens
allAdd anti-CSRF tokens to all state-changing requests
Requires application code modification - consult Tufin documentation
SameSite Cookie Attribute
allSet SameSite=Strict or SameSite=Lax attributes on session cookies
Set-Cookie: session=value; SameSite=Strict; Secure; HttpOnly
🧯 If You Can't Patch
- Implement network segmentation to isolate SecureTrack from untrusted networks
- Use web application firewalls (WAF) with CSRF protection rules
🔍 How to Verify
Check if Vulnerable:
Check SecureTrack version via web interface or command line. If version is earlier than R20-2 GA, system is vulnerable.Check Version:
Check web interface admin panel or consult Tufin documentation for version check commands specific to your deployment.Verify Fix Applied:
Verify version is R20-2 GA or later and test CSRF protections by attempting to submit requests without proper tokens.📡 Detection & Monitoring
Log Indicators:
- Multiple failed state-changing requests from same IP
- Unusual configuration changes without corresponding user actions
- Requests missing CSRF tokens
Network Indicators:
- HTTP POST requests to SecureTrack endpoints from unexpected referrers
- Cross-origin requests to administrative endpoints
SIEM Query:
source="securetrack" AND (http_method="POST" OR http_method="PUT") AND NOT csrf_token=*