CVE-2021-37381
📋 TL;DR
Southsoft GMIS 5.0 is vulnerable to Cross-Site Request Forgery (CSRF) attacks that allow unauthorized access to private student information, including photos. Attackers can exploit this by manipulating student ID parameters in URLs while using valid session tokens. This affects all users of Southsoft GMIS 5.0 who have access to student photo information.
💻 Affected Systems
- Southsoft GMIS
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Mass data exfiltration of all student private photos and personal information through automated CSRF attacks, leading to privacy violations and potential blackmail.
Likely Case
Targeted access to specific students' private photos by malicious actors, resulting in privacy breaches and potential harassment.
If Mitigated
No unauthorized access possible with proper CSRF protections and access controls in place.
🎯 Exploit Status
Exploitation requires the attacker to trick an authenticated user into visiting a malicious page or clicking a link. The exploit is simple and well-documented in public repositories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: No official vendor advisory found
Restart Required: No
Instructions:
No official patch available. Implement workarounds and consider upgrading to a newer version if available from the vendor.
🔧 Temporary Workarounds
Implement CSRF Tokens
allAdd anti-CSRF tokens to all state-changing requests and photo access endpoints
Implement unique per-session CSRF tokens in all forms and AJAX requests
Validate tokens server-side before processing requests
SameSite Cookie Attribute
allSet SameSite=Strict or SameSite=Lax attributes on session cookies
Set-Cookie: sessionid=xxx; SameSite=Strict; Secure; HttpOnly
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to detect and block CSRF patterns
- Restrict access to the vulnerable endpoints using network segmentation or IP whitelisting
🔍 How to Verify
Check if Vulnerable:
Test if photo access endpoints (/gmis/(S(*))/student/grgl/PotoImageShow/?bh=*) accept requests without valid CSRF tokens when initiated from external sitesCheck Version:
Check application version in admin panel or configuration files (typically shows 'GMIS 5.0')Verify Fix Applied:
Verify that all photo access endpoints require and validate CSRF tokens, and that SameSite cookie attributes are properly set📡 Detection & Monitoring
Log Indicators:
- Multiple photo access requests from same session with different student IDs
- Photo access requests without referrer headers or with external referrers
Network Indicators:
- External domains making requests to /gmis/*/student/grgl/PotoImageShow/ endpoints
- Rapid sequential access to different student photo URLs
SIEM Query:
source="web_logs" AND uri="/gmis/*/student/grgl/PotoImageShow/" AND (referrer="" OR NOT referrer CONTAINS "yourdomain.com")