CVE-2020-14043: Codiad CSRF Vulnerability
Summary
CVE-2020-14043: Codiad CSRF Vulnerability. Affects codiad/codiad versions >= 1.7.8, <= 2.8.4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Codiad is an open-source web-based integrated development environment (IDE) that allows users to edit and collaborate on code remotely. It provides features such as syntax highlighting, file management, and plugin support. Codiad versions 1.7.8 and later are affected by a Cross-Site Request Forgery (CSRF) vulnerability.
Vulnerability Detail
The CSRF vulnerability in Codiad allows an attacker to trick an admin user into unknowingly making a vulnerable request. Specifically, the request to download a plugin from the marketplace is only available to admin users and is not protected against CSRF attacks in the 'components/market/controller.php' file. Exploiting this vulnerability could lead to remote code execution. It is important to note that the vendor has stated that Codiad is no longer under active maintenance by core contributors.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The CSRF vulnerability in Codiad versions 1.7.8 and later can allow an attacker to execute remote code by tricking an admin user into making a vulnerable request. It is important to implement the recommended fix and consider migrating to an actively maintained alternative IDE. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for codiad/codiad →
FAQ
Codiad is an open-source web-based integrated development environment (IDE) that allows users to edit and collaborate on code remotely.
A CSRF vulnerability allows an attacker to trick a user into unknowingly performing actions on a web application without their consent or knowledge.
Remote code execution refers to the ability of an attacker to execute arbitrary code on a target system or application remotely.
Yes, it is recommended to implement CSRF protection for the vulnerable request in the 'components/market/controller.php' file.
No, the vendor has stated that Codiad is no longer under active maintenance by core contributors.
References
Related vulnerabilities
Recent vulnerabilities recorded for codiad/codiad.
