CSRF origin checking is not done on requests from the gateway to external components (controller, hub, eda)

Requirements to exploit:

TLS edge termination prior to a request being passed into the gateway. Any requests that were made via HTTPS will have referer checking in place of origin checking.
The attacker must have a CSRF form token associated with the user's CSRF cookie. This would mean that they'd need to make a cross-origin request to the platform via JavaScript using the victim's cookies (This should be blocked by most modern browsers), or otherwise find some other means of deriving this token.