Apache JSPWiki CSRF in UserPreferences.jsp

Root

Cause

Apache JSPWiki versions prior to 2.11.3 lack proper Cross-Site Request Forgery (CSRF) protections on the UserPreferences.jsp page. An attacker can craft a malicious request that, when executed by an authenticated user, modifies the email address associated with the victim's account [1].

Exploitation

To exploit this vulnerability, the attacker must trick a logged-in JSPWiki user into visiting a specially crafted page or link that submits a request to UserPreferences.jsp. No additional authentication is required beyond the victim's active session. The crafted request changes the email address on the account, after which the attacker can use the password reset feature on the login page to gain control of the account [1].

Impact

Successful exploitation allows the attacker to take over the victim's account by resetting the password via the modified email. This can lead to unauthorized access to wiki content, modification of pages, and potential further compromise depending on the user's privileges.

Mitigation

The vulnerability is fixed in Apache JSPWiki version 2.11.3 and later. Users are strongly advised to upgrade to the latest version to mitigate this and other security issues [1][3].