CakePHP allows method override parameters to bypass CSRF checks
Published 24 May 2022 · Updated 8 Nov 2023
Affected packages
- Affected
- >=4.0.0 <4.0.10
- Fixed in
- 4.0.10
composer require cakephp/cakephp:^4.0.10- Affected
- >=4.1.0 <4.1.4
- Fixed in
- 4.1.4
composer require cakephp/cakephp:^4.1.4Details
A vulnerability exists in CakePHP versions 4.0.x through 4.1.3. The CsrfProtectionMiddleware component allows method override parameters to bypass CSRF checks by changing the HTTP request method to an arbitrary string that is not in the list of request methods that CakePHP checks. Additionally, the route middleware does not verify that this overriden method (which can be an arbitrary string) is actually an HTTP method.
Is GHSA-9pgx-pf36-w46r in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected cakephp/cakephp, and gives you the command that fixes it.
References
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.