CVE-2022-24712: CodeIgniter4 Cross-Site Request Forgery (CSRF) Protection Bypass
Summary
CVE-2022-24712: CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. Affects codeigniter versions >= 4.0.0, < 4.1.9. Fixed in 4.1.9. How to fix ↓
Also tracked for
- codeigniter4/framework · Packagist
The same CVE-2022-24712 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
CodeIgniter4 is a PHP full-stack web framework and the 4.x branch of CodeIgniter. It provides developers with a set of tools and libraries for building web applications. The framework includes features such as routing, database access, and security mechanisms like Cross-Site Request Forgery (CSRF) protection. However, versions prior to 4.1.9 are vulnerable to a bypass in the CSRF protection mechanism.
Vulnerability Detail
The vulnerability in CodeIgniter4 versions prior to 4.1.9 allows remote attackers to bypass the CSRF protection. This can lead to unauthorized actions being performed on behalf of authenticated users, potentially compromising the security and integrity of the application. The vulnerability arises due to a lack of proper validation of the request method in the controller method. Attackers can exploit this by crafting malicious requests that bypass the CSRF protection.
How To Fix
Minimum fixed version
4.1.9
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If auto-routing is enabled, developers should check the request method in the controller method before processing. This can be done by using conditional statements to validate the request method. For example, in PHP, developers can use the $_SERVER['REQUEST_METHOD'] variable to check the request method and proceed accordingly. If auto-routing is disabled, developers can either avoid using $routes->add() and instead use HTTP verbs in routes, or check the request method in the controller method before processing.
Conclusion
The vulnerability in CodeIgniter4 versions prior to 4.1.9 allows for the bypass of the CSRF protection mechanism, potentially leading to unauthorized actions and compromising the application's security. Users should upgrade to version 4.1.9 and review their code to ensure proper validation of the request method. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for codeigniter →
FAQ
CodeIgniter4 is a PHP full-stack web framework that provides developers with tools and libraries for building web applications.
Cross-Site Request Forgery (CSRF) is an attack that tricks the victim into submitting a malicious request. It can lead to unauthorized actions being performed on behalf of the victim.
The CSRF protection bypass vulnerability in CodeIgniter4 versions prior to 4.1.9 occurs due to a lack of proper validation of the request method in the controller method. Attackers can exploit this by crafting malicious requests that bypass the CSRF protection.
The potential consequences of this vulnerability include unauthorized actions being performed on behalf of authenticated users, compromising the security and integrity of the application.
To fix this vulnerability, upgrade to CodeIgniter4 version 4.1.9 and ensure that the request method is properly checked in the controller method.
References
Related vulnerabilities
Recent vulnerabilities recorded for codeigniter.
