CVE-2021-27885
📋 TL;DR
This CVE describes a Cross-Site Request Forgery (CSRF) vulnerability in e107 CMS versions through 2.3.0. The usersettings.php file lacks proper e_TOKEN protection, allowing attackers to trick authenticated users into performing unintended actions. All e107 installations up to version 2.3.0 are affected.
💻 Affected Systems
- e107 CMS
📦 What is this software?
E107 by E107
⚠️ Risk & Real-World Impact
Worst Case
Attackers could change user settings, passwords, or administrative configurations, potentially leading to account takeover or site compromise.
Likely Case
Attackers trick authenticated users into changing their own settings or performing actions without their consent.
If Mitigated
With proper CSRF tokens implemented, requests would be rejected unless they contain valid session tokens.
🎯 Exploit Status
Exploitation requires the victim to be authenticated and visit a malicious page while logged in.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 2.3.0
Vendor Advisory: https://github.com/e107inc/e107/releases
Restart Required: No
Instructions:
1. Update to e107 version after 2.3.0. 2. Apply the patch from commit d9efdb9b5f424b4996c276e754a380a5e251f472. 3. Verify the e_TOKEN protection is properly implemented in usersettings.php.
🔧 Temporary Workarounds
Manual CSRF Token Implementation
allManually add e_TOKEN validation to usersettings.php
Edit usersettings.php to include proper e_TOKEN validation before processing requests
🧯 If You Can't Patch
- Implement web application firewall rules to detect and block CSRF attempts
- Educate users about CSRF risks and safe browsing practices
🔍 How to Verify
Check if Vulnerable:
Check if e107 version is 2.3.0 or earlier and examine usersettings.php for missing e_TOKEN validation.Check Version:
Check e107 admin panel or version.php file for version informationVerify Fix Applied:
Verify that usersettings.php includes proper e_TOKEN validation and test that CSRF requests are rejected.📡 Detection & Monitoring
Log Indicators:
- Multiple failed requests to usersettings.php without proper tokens
- Unusual user setting changes
Network Indicators:
- Requests to usersettings.php without Referer headers or with suspicious origins
SIEM Query:
source="web_logs" AND uri="/usersettings.php" AND NOT token_present=true🔗 References
- http://packetstormsecurity.com/files/161651/e107-CMS-2.3.0-Cross-Site-Request-Forgery.html
- https://github.com/e107inc/e107/commit/d9efdb9b5f424b4996c276e754a380a5e251f472
- https://github.com/e107inc/e107/releases
- http://packetstormsecurity.com/files/161651/e107-CMS-2.3.0-Cross-Site-Request-Forgery.html
- https://github.com/e107inc/e107/commit/d9efdb9b5f424b4996c276e754a380a5e251f472
- https://github.com/e107inc/e107/releases
