Cross-site request forgery in Mongoose - CVE-2017-11567

Detailed vulnerability description

The vulnerability allows a remote attacker to perform cross-site request forgery attacks.

The vulnerability exists due to insufficient validation of the HTTP request origin. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website, such as be leveraged to execute arbitrary code remotely.

How to mitigate CVE-2017-11567

Sources

• http://hyp3rlinx.altervista.org/advisories/MONGOOSE-WEB-SERVER-v6.5-CSRF-COMMAND-EXECUTION.txt
• http://seclists.org/fulldisclosure/2017/Sep/3
• https://www.exploit-db.com/exploits/42614/