CVE-2019-13376: phpBB Cross-Site Request Forgery (CSRF)
Summary
CVE-2019-13376: phpBB Cross-Site Request Forgery (CSRF). Affects phpbb/phpbb versions < 3.2.8. Fixed in 3.2.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpBB is a popular open-source forum software written in PHP. It provides a platform for users to create and manage online communities. The vulnerability identified as CVE-2019-13376 affects phpBB version 3.2.7. This version includes a feature called Remote Avatar, which allows users to set avatars hosted on external websites. However, due to a Cross-Site Request Forgery (CSRF) vulnerability, an attacker can exploit this feature to steal an Administration Control Panel session ID. This vulnerability also leads to stored Cross-Site Scripting (XSS) attacks.
Vulnerability Detail
The CSRF vulnerability in phpBB version 3.2.7 allows an attacker to trick an administrator into performing unintended actions on the forum. By crafting a malicious request, the attacker can steal the session ID of an administrator logged into the Administration Control Panel. This session ID can then be used to gain unauthorized access to the panel and perform administrative actions. Additionally, the vulnerability allows for the injection of malicious scripts into the forum, leading to stored XSS attacks. This can result in the execution of arbitrary code or the theft of sensitive information from users.
How To Fix
Minimum fixed version
3.2.8
This is the first release that contains the fix.
composer require phpbb/phpbb:3.2.8Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to version 3.2.8 is not immediately possible, users can implement a temporary workaround by disabling the Remote Avatar feature. This can be done by modifying the forum's configuration settings to disallow the use of external avatars. By doing so, the CSRF vulnerability can be mitigated until a proper upgrade can be performed.
Conclusion
The phpBB version 3.2.7 vulnerability (CVE-2019-13376) exposes forums to Cross-Site Request Forgery (CSRF) attacks and stored Cross-Site Scripting (XSS) attacks. To mitigate these risks, it is crucial to upgrade to phpBB version 3.2.8 or later. Disabling the Remote Avatar feature can serve as a temporary workaround. For further assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for phpbb/phpbb →
FAQ
phpBB is an open-source forum software written in PHP. It allows users to create and manage online communities.
Cross-Site Request Forgery (CSRF) is a type of attack that tricks a user into performing unintended actions on a website or web application.
The Remote Avatar feature in phpBB allows users to set avatars hosted on external websites.
This vulnerability can lead to unauthorized access to the Administration Control Panel and the execution of arbitrary code or theft of sensitive information through stored XSS attacks.
To protect your forum, it is recommended to upgrade phpBB to version 3.2.8 or later. Alternatively, you can disable the Remote Avatar feature until the upgrade can be performed.
Related vulnerabilities
Recent vulnerabilities recorded for phpbb/phpbb.
