CIRCL Vulnerability-Lookup 中存在的 CSRF 漏洞

The primary impact of this CSRF vulnerability lies in the potential for unauthorized modification of application state. An attacker could leverage this flaw to alter database entries, user data, or configurations within Vulnerability-Lookup. Successful exploitation requires the attacker to trick a logged-in user into visiting a malicious website or clicking a crafted link. The attacker's GET request, originating from the user's browser within their authenticated session, would be treated as legitimate by the server, leading to unintended consequences. This could result in data breaches, privilege escalation, or disruption of service, depending on the specific actions accessible via the vulnerable GET endpoints.

Organizations utilizing Vulnerability-Lookup in environments where user authentication is critical and state-changing operations are performed via GET requests are at risk. This includes deployments with custom integrations or extensions that may not have been thoroughly reviewed for CSRF vulnerabilities.

1. 2025-12-08Disclosure

   disclosure

1. 已保留2025-04-16
2. 发布日期2025-12-08
3. EPSS 更新日期2026-03-23

The recommended mitigation for CVE-2025-42616 is to immediately upgrade Vulnerability-Lookup to version 2.18.0 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds such as adding CSRF tokens to all state-changing GET requests. Web Application Firewalls (WAFs) configured to detect and block suspicious GET requests originating from untrusted sources can also provide a layer of protection. Review all GET requests that modify application state and ensure proper CSRF protection is in place. After upgrade, confirm by attempting to trigger a state-changing action via a GET request from an unauthenticated session; it should be rejected.