Cross-Site Request Forgery (CSRF) in modoboa/modoboa

Vulnerability

Overview

CVE-2023-2228 describes a Cross-Site Request Forgery (CSRF) vulnerability in Modoboa, an open-source mail hosting management platform. The root cause is that certain edit operations—specifically those for modifying domains and accounts—were not protected by CSRF tokens or method enforcement. The commit that fixes this issue adds @require_http_methods(["POST"]) decorators to the editdomain and editaccount view functions, indicating that previously these endpoints accepted GET requests, which is a common vector for CSRF attacks [1][4].

Exploitation

An attacker can craft a malicious web page or email that, when visited by an authenticated Modoboa administrator, triggers a GET request (or a crafted POST) to one of the vulnerable endpoints. No special privileges beyond the victim's admin session are required. The exploit does not require any user interaction beyond the victim clicking a link or loading a page while authenticated to Modoboa [2].

Impact

Successful exploitation could allow an attacker to perform unauthorized modifications to domain or account settings, potentially leading to privilege escalation, data tampering, or disruption of email services. For example, an attacker could change a domain's configuration or modify user account permissions without consent [3].

Mitigation

The vulnerability is fixed in Modoboa version 2.1.0. All users should upgrade to this version or later. No workarounds are documented; the fix involves restricting the HTTP methods allowed on the vulnerable endpoints [1][4].