VYPR
← All advisories
Moderate severityNVD Advisory· Published Feb 20, 2024· Updated Aug 22, 2024

Decidim vulnerable to possible CSRF attack at questionnaire templates preview

CVE-2023-47635

Description

Decidim is a participatory democracy framework. Starting in version 0.23.0 and prior to versions 0.27.5 and 0.28.0, the CSRF authenticity token check is disabled for the questionnaire templates preview. The issue does not imply a serious security thread as you need to have access also to the session cookie in order to see this resource. This URL does not allow modifying the resource but it may allow attackers to gain access to information which was not meant to be public. The issue is fixed in version 0.27.5 and 0.28.0. As a workaround, disable the templates functionality or remove all available templates.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
decidim-templatesRubyGems
>= 0.23.0, < 0.27.50.27.5

Affected products

1

Patches

2
57a4b4677874

Simplify the code related to questionnaire templates previews (#11743)

https://github.com/decidim/decidimAntti HukkanenOct 11, 2023via ghsa
commit
2 files changed · +4 −12
  • decidim-templates/app/controllers/decidim/templates/admin/questionnaire_templates_controller.rb+0 −2 modified
    @@ -8,8 +8,6 @@ module Admin
       class QuestionnaireTemplatesController < Decidim::Templates::Admin::ApplicationController
         include Decidim::TranslatableAttributes
 
-        skip_before_action :verify_authenticity_token, only: :preview
-
         helper_method :template
 
         def index
  • decidim-templates/app/packs/src/decidim/templates/admin/choose_template.js+4 −10 modified
    @@ -13,16 +13,10 @@ $(() => {
       return;
     }
     const params = new URLSearchParams({ id: id });
-    fetch(`${previewURL}?${params.toString()}`, {
-      method: "GET",
-      headers: { "Content-Type": "application/json" }
-    }).then((response) => response.text()).then((data) => {
-      const script = document.createElement("script");
-      script.type = "text/javascript";
-      script.innerHTML = data;
-      document.getElementsByTagName("head")[0].appendChild(script);
-    }).catch((error) => {
-      console.error(error); // eslint-disable-line no-console
+    Rails.ajax({
+      url: `${previewURL}?${params.toString()}`,
+      type: "GET",
+      error: (data) => (console.error(data))
     });
   }
5542227be66e

Load script on autocomplete change

https://github.com/decidim/decidimVera RojmanJun 19, 2020via ghsa
commit
4 files changed · +25 −10
  • decidim-admin/app/assets/javascripts/decidim/admin/bundle.js+5 −5 modified
  • decidim-admin/app/frontend/components/autocomplete.component.tsx+14 −4 modified
    @@ -118,18 +118,28 @@ export class Autocomplete extends React.Component<AutocompleteProps, Autocomplet
     this.setState({ selectedOption });
 
     if (this.props.changeURL) {
-
-alert(`requesting get for changeURL ${this.props.changeURL}`)
-
       axios.get(this.props.changeURL, {
         headers: {
-          Accept: "application/json"
+          Accept: "text/javascript"
         },
         withCredentials: true,
         params: {
           id: selectedOption.value
         }
       })
+      .then((response) => {
+        let script = document.createElement("script");
+        script.type = "text/javascript";
+        script.innerHTML = response.data;
+        document.getElementsByTagName("head")[0].appendChild(script);
+      })
+      .catch((error: any) => {
+        if (axios.isCancel(error)) {
+          console.log("Request canceled", error.message);
+        } else {
+          console.log(error)
+        }
+      });
     }
   }
  • decidim-templates/app/controllers/decidim/templates/admin/questionnaire_templates_controller.rb+2 −0 modified
    @@ -8,6 +8,8 @@ module Admin
       class QuestionnaireTemplatesController < Decidim::Templates::Admin::ApplicationController
         include Decidim::TranslatableAttributes
         
+        skip_before_action :verify_authenticity_token, only: :preview
+        
         helper_method :template
 
         def index
  • decidim-templates/app/views/decidim/templates/admin/questionnaire_templates/preview.js.erb+4 −1 modified
    @@ -1 +1,4 @@
-alert("preview!")
\ No newline at end of file
+/* eslint-disable no-var, prefer-template */
+(function () {
+  
+}());

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

10

News mentions

0

No linked articles in our index yet.