CVE-2017-16570
HIGHKeystoneJS < 4.0.0-beta.7 - Cross-Site Request Forgery via Missing x-csrf-token Header
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2017-16570. PoCs published by Saurabh Banawar.
AI-analyzed exploit summary This exploit demonstrates a CSRF bypass vulnerability in KeystoneJS 4.0.0 by submitting a crafted HTML form to create a new user without requiring CSRF protection. The form submits user details to the API endpoint, bypassing authentication checks.
Description
KeystoneJS before 4.0.0-beta.7 allows application-wide CSRF bypass by removing the CSRF parameter and value, aka SecureLayer7 issue number SL7_KEYJS_03. In other words, it fails to reject requests that lack an x-csrf-token header.
Exploits (1)
This exploit demonstrates a CSRF bypass vulnerability in KeystoneJS 4.0.0 by submitting a crafted HTML form to create a new user without requiring CSRF protection. The form submits user details to the API endpoint, bypassing authentication checks.
References (4)
Scores
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H