CVE-2021-47702: CSRF in OpenBMCS 2.4

The CSRF vulnerability in OpenBMCS 2.4 poses a significant risk because it allows attackers to masquerade as an authenticated administrator. By tricking a legitimate user into clicking a malicious link or visiting a crafted webpage, an attacker can initiate actions as if they were the administrator. This could include sending unauthorized emails, modifying system settings, or potentially gaining access to sensitive data stored within the OpenBMCS system. The blast radius extends to any user with administrative access, as their credentials can be exploited without their knowledge. While no direct precedent for exploitation of this specific vulnerability is publicly known, CSRF vulnerabilities are frequently exploited in web applications, and this vulnerability's impact is amplified by the administrative privileges it grants.

1. Reserved2025-12-05
2. Published2025-12-09
3. Modified2026-04-07
4. EPSS updated2026-04-12

The primary mitigation for CVE-2021-47702 is to upgrade to a patched version of OpenBMCS as soon as it becomes available. Until a patch is released, implement temporary workarounds to reduce the risk. These include implementing strict input validation on the sendFeedback.php endpoint to prevent malicious data from being processed. Additionally, consider implementing CSRF tokens on all administrative actions to ensure that requests originate from a trusted source. Web Application Firewalls (WAFs) can be configured to detect and block suspicious CSRF attempts. Regularly review OpenBMCS logs for any unusual activity or signs of exploitation. After upgrading, confirm the fix by attempting to trigger an administrative action via a crafted CSRF request and verifying that it is blocked.