CVE-2018-7216

Vulnerability

A cross-site request forgery (CSRF) vulnerability exists in the Bravo Tejari Procurement Portal, specifically in the esop/toolkit/profile/regData.do endpoint [1]. The application fails to include anti-CSRF tokens in its forms, allowing an attacker to forge requests that modify user profile data. The affected component is the Web Interface Management, and all versions of the Bravo Solution without CSRF protection are vulnerable [1].

Exploitation

An attacker crafts a malicious HTML page containing a forged HTTP POST request to regData.do with parameters such as userAct=confirmData and fields for name, address, and email [1]. The attacker then uses social engineering (e.g., sending a link) to trick an authenticated user into clicking the malicious form. Upon submission, the victim's browser automatically includes their session cookies, executing the unauthorized request [1]. No special network position or additional privileges beyond the victim's session are required.

Impact

Successful exploitation allows the attacker to modify the victim's personal data, including name, company address, and email address [1]. This can lead to account takeover, unauthorized access, or further phishing attacks. The attacker gains the ability to alter sensitive user information without the victim's knowledge, potentially affecting the integrity and availability of user accounts [1].

Mitigation

As of the publication date (2018-02-18), no fix has been disclosed in the available reference [1]. The vendor (Tejari) should implement anti-CSRF tokens (e.g., random tokens validated on each state-changing request) and enforce same-origin checks. Until a patch is available, users can mitigate risk by enforcing strict cookie policies, using browser extensions that block CSRF, and educating users to avoid clicking untrusted links while authenticated.