Description
CakePHP 2.x and 3.x before 3.1.5 might allow remote attackers to bypass the CSRF protection mechanism via the _method parameter.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 11 | cakephp | 2.8.0-1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | cakephp/cakephp | >= 2.0.0-alpha, < 3.1.5 | 3.1.5 | GHSA-556q-h4vr-pgh2 |
References
- http://packetstormsecurity.com/files/135301/CakePHP-3.2.0-CSRF-Bypass.html
- http://blog.mindedsecurity.com/2016/01/request-parameter-method-may-lead-to.html
- 20160115 [KIS-2016-01] CakePHP <= 3.2.0 "_method" CSRF Protection Bypass Vulnerability mailing-list
- http://karmainsecurity.com/KIS-2016-01
- http://bakery.cakephp.org/2015/11/29/cakephp_315_released.html
- 20160115 [KIS-2016-01] CakePHP <= 3.2.0 "_method" CSRF Protection Bypass Vulnerability mailing-list
- https://github.com/cakephp/cakephp/commit/0f818a23a876c01429196bf7623e1e94a50230f0