CVE-2021-3901
📋 TL;DR
CVE-2021-3901 is a Cross-Site Request Forgery (CSRF) vulnerability in Firefly III personal finance software that allows attackers to trick authenticated users into performing unintended actions. This affects all Firefly III users with active sessions, potentially leading to unauthorized financial transactions or account modifications.
💻 Affected Systems
- Firefly III
📦 What is this software?
Firefly Iii by Firefly Iii
⚠️ Risk & Real-World Impact
Worst Case
Attackers could manipulate financial data, create fraudulent transactions, modify account settings, or delete financial records without the user's knowledge.
Likely Case
Unauthorized financial transactions or account modifications performed by tricking authenticated users into clicking malicious links.
If Mitigated
With proper CSRF protections and user awareness, impact is limited to failed attack attempts with no successful exploitation.
🎯 Exploit Status
CSRF attacks require user interaction but are well-understood and easy to implement. The vulnerability was publicly disclosed with technical details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Commit b42d8d1e305cad70d9b83b33cd8e0d7a4b2060c2 and later
Vendor Advisory: https://github.com/firefly-iii/firefly-iii/commit/b42d8d1e305cad70d9b83b33cd8e0d7a4b2060c2
Restart Required: Yes
Instructions:
1. Update Firefly III to the latest version. 2. Apply commit b42d8d1e305cad70d9b83b33cd8e0d7a4b2060c2. 3. Restart the web server. 4. Clear browser caches for all users.
🔧 Temporary Workarounds
Enable CSRF Protection
allEnsure CSRF tokens are properly implemented and validated for all state-changing requests.
Check that 'VerifyCsrfToken' middleware is enabled in app/Http/Middleware
SameSite Cookie Restrictions
allConfigure session cookies with SameSite=Strict or Lax attributes to prevent cross-site requests.
Set 'session.cookie_samesite' to 'Strict' in .env configuration
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to detect and block CSRF patterns
- Educate users about phishing risks and safe browsing practices
🔍 How to Verify
Check if Vulnerable:
Check if your Firefly III version predates commit b42d8d1e305cad70d9b83b33cd8e0d7a4b2060c2Check Version:
git log --oneline -1Verify Fix Applied:
Verify that CSRF tokens are present in all forms and validated on submission📡 Detection & Monitoring
Log Indicators:
- Multiple failed CSRF token validations from same IP
- Unusual POST requests without referrer headers
Network Indicators:
- Cross-origin requests to Firefly III endpoints
- Requests missing CSRF tokens
SIEM Query:
source="firefly-iii" AND (event="csrf_token_mismatch" OR status=419)🔗 References
- https://github.com/firefly-iii/firefly-iii/commit/b42d8d1e305cad70d9b83b33cd8e0d7a4b2060c2
- https://huntr.dev/bounties/62508fdc-c26b-4312-bf75-fd3a3f997464
- https://github.com/firefly-iii/firefly-iii/commit/b42d8d1e305cad70d9b83b33cd8e0d7a4b2060c2
- https://huntr.dev/bounties/62508fdc-c26b-4312-bf75-fd3a3f997464
