Cross-site Request Forgery (CSRF) Affecting webkitgtk package, versions [,2.45.4)
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Cross-site Request Forgery (CSRF) vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-UNMANAGED-WEBKITGTK-7654160
- published9 Aug 2024
- disclosed6 Aug 2024
- creditAvi Lumelsky
Introduced: 6 Aug 2024
CVE NOT AVAILABLE CWE-352 (opens in a new tab)How to fix?
Upgrade webkitgtk to version 2.45.4 or higher.
Overview
Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF) against the 0.0.0.0 address, which is not included in the Private Network Access specification. Browser implementations that allow treating this address as a destination for requests may expose the application to DNS rebinding attacks or remote code execution. This is a common scenario because all traffic involving 0.0.0.0 is presumed to be local and therefore the same safeguards may not be in place as would be for a normal remote request. CORS protections do not strictly need to be bypassed because no response is needed for code execution to succeed.
Workarounds
This vulnerability can be avoided by various means including implementing PNA headers, CSRF tokens, HTTPS or host authorization checks - even for local requests.