Cross-Site Request Forgery (CSRF) in modoboa/modoboa

Root

Cause

Modoboa, a mail hosting management platform, lacked CSRF protection on the deldomain endpoint. The vulnerable code in modoboa/admin/views/domain.py only required login and delete permission but did not enforce a POST-only restriction or include a CSRF token check. This allowed attackers to craft a request that, when triggered by an authenticated administrator, would delete a domain without the admin's intent [1][4].

Attack

Vector

An attacker can exploit this by tricking an authenticated Modoboa administrator into visiting a malicious page or clicking a link that sends a crafted HTTP request to the deldomain endpoint. No special network position is required; the attack can be performed remotely via social engineering or cross-site scripting if available. The administrator must be currently logged into Modoboa for the CSRF to succeed [2].

Impact

Successful exploitation results in unauthorized deletion of email domains managed by Modoboa, potentially causing disruption of mail services and loss of domain configuration. The attacker does not gain direct access to the system but can cause administrative actions to be performed without consent [1][3].

Mitigation

The fix was introduced in commit 8e14ac93669df4f35fcdebd55dc9d2f0fed3ed48, which adds the @require_http_methods(['POST']) decorator to the deldomain view, ensuring only POST requests are accepted. This change was included in modoboa version 2.0.4. Users are advised to upgrade to this version or later [1][4].