CVE-2021-45785
📋 TL;DR
This CSRF vulnerability in TruDesk Help Desk/Ticketing Solution v1.1.11 allows attackers to force privileged users to restart the server via a crafted webpage, causing a denial of service. Attackers need to know the target's TruDesk URL and trick an authenticated admin into visiting their malicious page. Only TruDesk v1.1.11 installations with admin users are affected.
💻 Affected Systems
- TruDesk Help Desk/Ticketing Solution
📦 What is this software?
Trudesk by Trudesk Project
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption through server restart, potentially causing extended downtime and data loss if restart fails or corrupts data.
Likely Case
Temporary service interruption during server restart, disrupting help desk operations for minutes.
If Mitigated
No impact if CSRF protections are implemented or admin users avoid untrusted websites.
🎯 Exploit Status
Exploit requires crafting simple HTML page with GET request to target endpoint and social engineering admin to visit it.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v1.1.12 or later
Vendor Advisory: https://github.com/trudesk/trudesk/releases
Restart Required: Yes
Instructions:
1. Backup current installation. 2. Download latest version from GitHub. 3. Replace files with patched version. 4. Restart TruDesk service.
🔧 Temporary Workarounds
Implement CSRF Tokens
allAdd CSRF protection to /api/v1/admin/restart endpoint
Modify API endpoint to require CSRF token validation
Restrict Admin Access
allLimit admin user access to trusted networks only
Configure firewall rules to restrict /api/v1/admin/* endpoints to internal IPs
🧯 If You Can't Patch
- Implement web application firewall with CSRF protection rules
- Educate admin users to avoid clicking untrusted links while authenticated
🔍 How to Verify
Check if Vulnerable:
Check if TruDesk version is 1.1.11 and /api/v1/admin/restart endpoint accepts GET requests without CSRF tokensCheck Version:
Check package.json or admin panel for version informationVerify Fix Applied:
Verify version is 1.1.12+ and /api/v1/admin/restart endpoint requires POST with CSRF token📡 Detection & Monitoring
Log Indicators:
- Multiple GET requests to /api/v1/admin/restart from same IP
- Server restart logs without corresponding admin UI actions
Network Indicators:
- External requests to /api/v1/admin/restart endpoint
- GET requests to restart endpoint instead of POST
SIEM Query:
source="truesk_logs" AND uri="/api/v1/admin/restart" AND method="GET"