CVE-2021-47702
📋 TL;DR
OpenBMCS 2.4 contains a CSRF vulnerability in the sendFeedback.php endpoint that allows attackers to trick authenticated administrators into performing unintended actions. This could lead to unauthorized email sending or system configuration changes. Only OpenBMCS 2.4 installations with administrative web interfaces are affected.
💻 Affected Systems
- OpenBMCS
📦 What is this software?
Openbmcs by Openbmcs
⚠️ Risk & Real-World Impact
Worst Case
Attackers could modify system settings, send malicious emails from the system, or potentially chain with other vulnerabilities for further compromise.
Likely Case
Attackers send spam or phishing emails from the vulnerable system, or make minor configuration changes.
If Mitigated
With proper CSRF protections and administrative awareness, impact is limited to unsuccessful attack attempts.
🎯 Exploit Status
Exploitation requires tricking an authenticated administrator to visit a malicious page; exploit code is publicly available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not specified
Vendor Advisory: https://www.openbmcs.com
Restart Required: No
Instructions:
No official patch available; implement workarounds or upgrade to a newer version if available.
🔧 Temporary Workarounds
Implement CSRF Tokens
allAdd CSRF protection tokens to sendFeedback.php and verify them on submission.
Modify sendFeedback.php to include and validate CSRF tokens
Restrict Access to sendFeedback.php
allLimit access to the vulnerable endpoint via web server configuration or authentication.
Add access control rules in Apache/Nginx configuration for sendFeedback.php
🧯 If You Can't Patch
- Implement strict SameSite cookie policies and require re-authentication for sensitive actions.
- Use web application firewalls (WAF) to detect and block CSRF attempts.
🔍 How to Verify
Check if Vulnerable:
Check if sendFeedback.php exists and lacks CSRF protection by reviewing the source code or testing with CSRF PoC tools.Check Version:
Check OpenBMCS version in web interface or configuration files.Verify Fix Applied:
Test that sendFeedback.php now requires valid CSRF tokens and rejects unauthorized requests.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to sendFeedback.php from unexpected sources or without referrer headers.
Network Indicators:
- HTTP requests to sendFeedback.php with parameters typical for CSRF attacks.
SIEM Query:
source="web_logs" AND uri="/sendFeedback.php" AND method="POST" AND NOT referrer CONTAINS "expected_domain"