OpenBMCS Cross Site Request Forgery (CSRF) via sendFeedback.php

The CSRF vulnerability in OpenBMCS 2.4 poses a significant risk because it allows attackers to masquerade as an authenticated administrator. By tricking a legitimate user into clicking a malicious link or visiting a crafted webpage, an attacker can initiate actions as if they were the administrator. This could include sending unauthorized emails, modifying system settings, or potentially gaining access to sensitive data stored within the OpenBMCS system. The blast radius extends to any user with administrative access, as their credentials can be exploited without their knowledge. While no direct precedent for exploitation of this specific vulnerability is publicly known, CSRF vulnerabilities are frequently exploited in web applications, and this vulnerability's impact is amplified by the administrative privileges it grants.

Organizations and individuals utilizing OpenBMCS version 2.4 are at risk. This includes those deploying OpenBMCS in environments with limited security controls or those who rely on OpenBMCS for critical system monitoring and management functions. Shared hosting environments where multiple users share the same OpenBMCS instance are particularly vulnerable.

• php / web:

curl -I 'http://your-openbmcs-server/sendFeedback.php?action=some_admin_action' | grep -i 'referer'

• php / web: Examine access logs for unusual referer headers preceding administrative actions. • php / web: Review OpenBMCS configuration files for any insecure settings related to session management or authentication. • generic web: Monitor network traffic for suspicious POST requests to sendFeedback.php with unexpected parameters.

1. 2025-12-09Disclosure

   disclosure

1. Reserviert2025-12-05
2. Veröffentlicht2025-12-09
3. Geändert2026-04-07
4. EPSS aktualisiert2026-04-12

The primary mitigation for CVE-2021-47702 is to upgrade to a patched version of OpenBMCS as soon as it becomes available. Until a patch is released, implement temporary workarounds to reduce the risk. These include implementing strict input validation on the sendFeedback.php endpoint to prevent malicious data from being processed. Additionally, consider implementing CSRF tokens on all administrative actions to ensure that requests originate from a trusted source. Web Application Firewalls (WAFs) can be configured to detect and block suspicious CSRF attempts. Regularly review OpenBMCS logs for any unusual activity or signs of exploitation. After upgrading, confirm the fix by attempting to trigger an administrative action via a crafted CSRF request and verifying that it is blocked.