Bug 2238908 (CVE-2023-4959)

Summary: CVE-2023-4959 quay: Cross-Site Request Forgery (CSRF) on config-editor page
Product: [Other] Security Response Reporter: Avinash Hanwate <ahanwate>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: bdettelb, security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Quay. Cross-site request forgery (CSRF) attacks force a user to perform unwanted actions in an application. During the pentest, it was detected that the config-editor page is vulnerable to CSRF. The config-editor page is used to configure the Quay instance. By coercing the victim’s browser into sending an attacker-controlled request from another domain, it is possible to reconfigure the Quay instance (including adding users with admin privileges).
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2237319    

Description Avinash Hanwate 2023-09-14 09:14:11 UTC 
Cross-Site Request Forgery or CSRF attacks force a user to perform unwanted actions in an application. Through the use of techniques such as social engineering (e.g. sending a link via email), or existing vulnerabilities in the domain itself or others (e.g. XSS), the attacker gets users of the web application to silently execute actions in the context of the user's session. The consequences of exploiting this vulnerability range from compromising the data or operations of a user, to the compromise of the entire web application, if the user has the role of "Administrator".
During the pentest, it has been detected that the config-editor page (https://example-registry-quay-config-editor-openshift-operators.apps.automagic.gcp.quaydev.org/) is vulnerable to CSRF. The config-editor page is used to configure the Quay instance.