Redaxo CMS 5.2 Cross-Site Request Forgery a través del endpoint de usuarios

The primary impact of CVE-2016-20053 is the unauthorized creation of administrative user accounts. An attacker can craft HTML forms targeting the users endpoint, embedding hidden fields containing the necessary credentials and account parameters. By tricking an authenticated administrator into visiting a page containing this malicious form, the attacker can effectively add a new administrator account without the administrator's knowledge or consent. This grants the attacker full administrative privileges, enabling them to modify content, install malicious code, and potentially compromise the entire Redaxo CMS installation. The blast radius extends to all data and functionality accessible through the CMS, including sensitive user information and critical website configurations.

Websites and applications relying on Redaxo CMS versions 5.2–5.2 are at risk. This includes organizations with limited security expertise or those who have not regularly updated their CMS installations. Shared hosting environments using Redaxo CMS are particularly vulnerable, as attackers could potentially compromise multiple websites from a single point of entry.

• php / web:

curl -I 'http://example.com/users?admin_username=attacker&admin_password=password'

• php / web: Examine access logs for suspicious requests to the /users endpoint with POST data containing adminusername and adminpassword parameters. • php / web: Review Redaxo CMS configuration files for any insecure settings related to user creation or authentication. • generic web: Monitor for new administrative user accounts created without proper authorization.

1. 2026-04-04Disclosure

   disclosure

1. Reservado2026-04-04
2. Publicada2026-04-04
3. Modificada2026-04-06
4. EPSS actualizado2026-04-12

The primary mitigation for CVE-2016-20053 is to upgrade Redaxo CMS to a version that includes the security patch. Unfortunately, the specific fixed version is not provided. If upgrading immediately is not feasible, consider implementing temporary workarounds such as implementing strict input validation on the users endpoint to prevent malicious data from being submitted. Additionally, consider using a Web Application Firewall (WAF) with CSRF protection rules to filter out malicious requests. Regularly review user accounts and permissions to identify any unauthorized accounts that may have been created.