Apache JSPWiki CSRF Account Takeover

Vulnerability

A cross-site request forgery (CSRF) vulnerability exists in the Apache JSPWiki user preferences form. An attacker can trick an authenticated user into submitting a crafted request, modifying the victim's account settings. This affects Apache JSPWiki versions up to and including 2.11.1 [1][2].

Exploitation

The attacker must craft a malicious web page or link that triggers a state-changing request to the JSPWiki user preferences endpoint. The victim must be authenticated to the JSPWiki instance and visit the attacker's page while having an active session [1][2].

Impact

A successful CSRF attack can lead to account takeover. The attacker can change arbitrary preferences, including the user's password or other account settings, thereby gaining full control of the victim's account [1][2].

Mitigation

Users should upgrade to Apache JSPWiki 2.11.2 or later. Additionally, installations running version 2.7.0 or later can enable manual approval for user management workflows as a partial workaround [2].