Cross-Site Request Forgery (CSRF) in livehelperchat/livehelperchat

Vulnerability

Live Helper Chat versions prior to commit 3b5d0a8 are vulnerable to Cross-Site Request Forgery (CSRF) on the /system/expirecache endpoint. The endpoint lacked CSRF token validation, allowing an attacker to forge requests that clear the application cache. The affected code path is in design/defaulttheme/tpl/lhsystem/configuration_links and the expirecache view definition [1][2][3].

Exploitation

An attacker must trick an authenticated administrator into visiting a malicious page or clicking a crafted link. The attacker can craft a GET or POST request to the /system/expirecache endpoint without any CSRF token. If the administrator is logged in, the browser automatically includes session cookies, and the request is processed, clearing the cache [3].

Impact

Successful exploitation allows an attacker to clear the application cache, which can cause temporary denial of service or force the system to regenerate cached data. No data loss or privilege escalation occurs, but the action disrupts normal operation [2][3].

Mitigation

The fix was implemented in commit 3b5d0a8 by adding CSRF token validation to the expirecache endpoint. The commit adds a check using $currentUser->validateCSFRToken() and requires a csfr parameter in the URL. Users should update to a version that includes this commit. No workaround is available other than ensuring administrators do not follow untrusted links [3].