Cross-Site Request Forgery (CSRF) Protection Bypass Vulnerability in CodeIgniter4

Vulnerability

A vulnerability in CodeIgniter4 versions prior to 4.1.9 allows remote attackers to bypass the Cross-Site Request Forgery (CSRF) protection mechanism. The exact root cause is not detailed, but it affects all configurations using the framework's CSRF protection. Upgrade to version 4.1.9 to fix the issue [1][2][3].

Exploitation

An attacker can exploit this vulnerability by crafting a malicious request that bypasses the CSRF token validation. No authentication is required, as CSRF exploits typically target authenticated sessions. The attack vector is network-based, requiring the victim to visit a malicious page or click a link while authenticated to the target application [2].

Impact

Successful exploitation allows an attacker to perform actions on behalf of an authenticated user without their knowledge, leading to unauthorized state-changing operations such as data modification, deletion, or privilege escalation. The exact impact depends on the application's functionality [1][2].

Mitigation

Users should upgrade to CodeIgniter4 version 4.1.9 or later, released on February 25, 2022 [3]. For those unable to upgrade, workarounds include checking the request method in controller methods (e.g., only accepting POST for sensitive actions) and avoiding $routes->add() in favor of HTTP-verb-specific routes [2]. Note that these workarounds require additional coding even after upgrading to ensure CSRF protection [1][2].