CVE-2025-9747
📋 TL;DR
This CSRF vulnerability in Koillection allows attackers to trick authenticated users into performing unintended actions by manipulating requests. It affects all Koillection instances up to version 1.6.18. The vulnerability is in the CSRF protection controller and can be exploited remotely.
💻 Affected Systems
- Koillection
📦 What is this software?
Koillection by Benjaminjonard
⚠️ Risk & Real-World Impact
Worst Case
Attackers could perform unauthorized actions on behalf of authenticated users, potentially modifying collections, deleting data, or changing account settings.
Likely Case
Attackers trick users into performing unintended actions within their Koillection instance, such as adding/removing items or modifying preferences.
If Mitigated
With proper CSRF protections, requests would be rejected without valid tokens, preventing unauthorized actions.
🎯 Exploit Status
Exploit requires user interaction but is technically simple. Attackers need to trick authenticated users into visiting malicious pages.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.7.0
Vendor Advisory: https://github.com/benjaminjonard/koillection/releases/tag/1.7.0
Restart Required: Yes
Instructions:
1. Backup your Koillection instance and database. 2. Download version 1.7.0 from the official repository. 3. Replace existing files with the new version. 4. Clear any caches. 5. Restart your web server.
🔧 Temporary Workarounds
Implement custom CSRF protection
allAdd custom CSRF token validation to all state-changing endpoints
Use SameSite cookie attribute
allConfigure session cookies with SameSite=Strict to limit cross-site requests
🧯 If You Can't Patch
- Implement WAF rules to detect and block CSRF patterns
- Monitor for unusual user activity and implement rate limiting on sensitive endpoints
🔍 How to Verify
Check if Vulnerable:
Check Koillection version in admin panel or by examining package.json file. If version is 1.6.18 or lower, you are vulnerable.Check Version:
Check Koillection admin panel or examine the package.json file for version information.Verify Fix Applied:
After upgrading to 1.7.0, verify that CSRF tokens are properly generated and validated for all POST/PUT/DELETE requests.📡 Detection & Monitoring
Log Indicators:
- Multiple failed CSRF token validations from same IP
- Unusual POST requests without referrer headers
Network Indicators:
- Cross-origin requests to Koillection endpoints without proper referrer validation
SIEM Query:
source="koillection" AND (event="csrf_failure" OR event="invalid_token")🔗 References
- https://github.com/benjaminjonard/koillection/commit/9ab8562d3f1e953da93fed63f9ee802c7ea26a9a
- https://github.com/benjaminjonard/koillection/issues/1393
- https://github.com/benjaminjonard/koillection/issues/1393#issue-3347724086
- https://github.com/benjaminjonard/koillection/issues/1393#issuecomment-3217310072
- https://github.com/benjaminjonard/koillection/releases/tag/1.7.0
- https://vuldb.com/?ctiid.322047
- https://vuldb.com/?id.322047
- https://vuldb.com/?submit.640421
- https://github.com/benjaminjonard/koillection/issues/1393
- https://github.com/benjaminjonard/koillection/issues/1393#issue-3347724086
- https://github.com/benjaminjonard/koillection/issues/1393#issuecomment-3217310072
