Cross-Site Request Forgery (CSRF) in modoboa/modoboa

Vulnerability

Overview

CVE-2023-0406 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the delaccount view in Modoboa, an open-source mail hosting and management platform [3]. The vulnerability existed in versions prior to 2.0.4 and allowed an attacker to delete user accounts without proper CSRF protection [1][2]. The root cause was that the account deletion endpoint did not enforce POST-only HTTP methods and lacked CSRF token validation, as indicated by the commit that added the @require_http_methods(["POST"]) decorator and enforced CSRF checks [4].

Exploitation

To exploit this vulnerability, an attacker would need to trick an authenticated administrator into visiting a malicious webpage or clicking a crafted link. Because the delete-user endpoint accepted GET requests without CSRF tokens, a simple `` tag or form submission could trigger the unauthorized deletion of a targeted user account. No advanced authentication bypass was required; the attacker merely needed to lure a logged-in admin to the crafted request.

Impact

A successful CSRF attack could result in the arbitrary deletion of user accounts on the Modoboa instance. This could lead to denial of service for legitimate users, loss of email data, and potential disruption of mail services. The severity is elevated because administrative privileges are required for the target session, but the attack does not require the attacker to have direct access to the Modoboa interface.

Mitigation

The vulnerability was patched in Modoboa release 2.0.4, which enforced POST-only requests and proper CSRF validation for the delete-account view [4]. Users are strongly advised to upgrade to version 2.0.4 or later. No workarounds were documented; applying the fix is the recommended course of action.