Critical CSRF Vulnerability Discovered in Casdoor 2.95.0 Authentication Platform

Casdoor 2.95.0 Affected by Critical Cross-Site Request Forgery (CSRF) Vulnerability

Security researchers have uncovered a cross-site request forgery (CSRF) vulnerability in Casdoor 2.95.0, an open-source authentication platform widely used for identity and access management (IAM). The flaw, tracked under Exploit-DB ID 52439, allows attackers to perform unauthorized actions on behalf of authenticated users, potentially leading to account takeovers or privilege escalation.

Technical Details of the CSRF Flaw

The vulnerability stems from missing CSRF protection mechanisms in Casdoor 2.95.0, enabling attackers to craft malicious requests that execute unintended actions when a victim interacts with a compromised or malicious website. Common attack vectors include:

• Session hijacking via forged HTTP requests
• Unauthorized account modifications (e.g., password changes, email updates)
• Privilege escalation if the victim holds administrative access

The exploit does not require direct access to the target system but relies on social engineering to trick users into clicking a malicious link or visiting a compromised webpage.

Impact and Risk Assessment

Organizations using Casdoor 2.95.0 for authentication face high-risk exposure, particularly in environments where:

• Multi-factor authentication (MFA) is not enforced
• Session management lacks additional validation layers
• Administrative users are targeted for privilege escalation

Successful exploitation could result in data breaches, unauthorized system access, or lateral movement within a network. The flaw is particularly concerning for enterprises relying on Casdoor for single sign-on (SSO) or API security.

Recommended Mitigations

Security teams are advised to take the following actions:

1. Upgrade Immediately – Apply the latest patch or update to a non-vulnerable version of Casdoor.
2. Implement CSRF Tokens – Ensure all state-changing requests include anti-CSRF tokens.
3. Enforce MFA – Add an extra layer of security for sensitive operations.
4. User Awareness Training – Educate employees on recognizing phishing and social engineering tactics.
5. Monitor for Suspicious Activity – Audit logs for unusual account modifications or unauthorized access attempts.

For further details, refer to the original exploit disclosure on Exploit-DB (ID 52439).