Summary
Leantime 3.6.2 contains a cross-site request forgery vulnerability that allows attackers to force authenticated users' browsers to perform state-changing actions without their consent.
Because the Laravel VerifyCsrfToken middleware is excluded from the global middleware stack, crafted malicious pages can trigger unauthorized POST, PUT, and DELETE requests against the application.
Leantime 3.6.2 contains a cross-site request forgery vulnerability that allows attackers to force authenticated users' browsers to perform state-changing actions without their consent.
Because the Laravel VerifyCsrfToken middleware is excluded from the global middleware stack, crafted malicious pages can trigger unauthorized POST, PUT, and DELETE requests against the application.
Affected context
This vulnerability occurs in Leantime deployments where HTTP routes that perform state-changing operations (such as project creation, deletion, settings changes, and permission updates) are not protected by CSRF validation middleware. It is most relevant when users are authenticated in a browser session and can be induced to visit attacker-controlled content (e.g., via phishing emails or malicious websites) while still logged into Leantime.
This vulnerability occurs in Leantime deployments where HTTP routes that perform state-changing operations (such as project creation, deletion, settings changes, and permission updates) are not protected by CSRF validation middleware. It is most relevant when users are authenticated in a browser session and can be induced to visit attacker-controlled content (e.g., via phishing emails or malicious websites) while still logged into Leantime.
Exploit preconditions
- Attack surface: Browser-based interactions with Leantime's web interface and HTTP endpoints.
- Required access: Ability to host or inject attacker-controlled HTML/JavaScript on a page visited by an authenticated Leantime user.
- Trigger point: User's browser automatically submits crafted POST, PUT, or DELETE requests to Leantime while the user session is active.
- Why exploitation is possible: The Laravel VerifyCsrfToken middleware is excluded from the global middleware stack, so the application does not verify CSRF tokens on sensitive routes and implicitly trusts authenticated session cookies alone.
- Attack surface: Browser-based interactions with Leantime's web interface and HTTP endpoints.
- Required access: Ability to host or inject attacker-controlled HTML/JavaScript on a page visited by an authenticated Leantime user.
- Trigger point: User's browser automatically submits crafted POST, PUT, or DELETE requests to Leantime while the user session is active.
- Why exploitation is possible: The Laravel VerifyCsrfToken middleware is excluded from the global middleware stack, so the application does not verify CSRF tokens on sensitive routes and implicitly trusts authenticated session cookies alone.
Why this happens
The underlying bug class is missing or improperly configured CSRF protection for state-changing endpoints. By excluding Laravel's VerifyCsrfToken middleware from the global middleware stack, Leantime fails to enforce token-based validation for cross-origin form submissions or requests initiated from arbitrary web pages. This maps to CWE-352: Cross-Site Request Forgery (CSRF), where an application relies solely on ambient authentication (such as cookies) and does not require a user-specific, non-guessable token to distinguish legitimate user actions from attacker-forced requests.
The underlying bug class is missing or improperly configured CSRF protection for state-changing endpoints. By excluding Laravel's VerifyCsrfToken middleware from the global middleware stack, Leantime fails to enforce token-based validation for cross-origin form submissions or requests initiated from arbitrary web pages. This maps to CWE-352: Cross-Site Request Forgery (CSRF), where an application relies solely on ambient authentication (such as cookies) and does not require a user-specific, non-guessable token to distinguish legitimate user actions from attacker-forced requests.
Potential impact
- Attackers may create, modify, or delete projects as any authenticated user.
- Attackers could change application configuration settings without user knowledge.
- Permissions and roles can be altered, potentially granting broader access to attacker-controlled accounts.
- Project data and workflows may be disrupted or sabotaged.
- Administrative actions could be performed indirectly via compromised user sessions.
- Attackers may create, modify, or delete projects as any authenticated user.
- Attackers could change application configuration settings without user knowledge.
- Permissions and roles can be altered, potentially granting broader access to attacker-controlled accounts.
- Project data and workflows may be disrupted or sabotaged.
- Administrative actions could be performed indirectly via compromised user sessions.
General mitigation guidance
Effective mitigation focuses on ensuring that all state-changing routes are protected by robust CSRF defenses and minimizing trust in implicit browser authentication. Common secure patterns include:
- Enabling and consistently applying CSRF validation middleware for POST, PUT, DELETE, and other non-idempotent operations.
- Designing forms and API interactions to require a per-session or per-request CSRF token that is bound to the user and not predictable.
- Restricting sensitive actions to well-defined HTTP methods and avoiding state changes via GET requests.
- Applying principle of least privilege so that compromised user accounts cannot perform high-impact administrative changes without additional verification (e.g., re-authentication or step-up checks).
- Considering the addition of defense-in-depth mechanisms such as same-site cookies, origin/referrer checks for critical endpoints, and explicit confirmation flows for high-risk actions.
Effective mitigation focuses on ensuring that all state-changing routes are protected by robust CSRF defenses and minimizing trust in implicit browser authentication. Common secure patterns include:
- Enabling and consistently applying CSRF validation middleware for POST, PUT, DELETE, and other non-idempotent operations.
- Designing forms and API interactions to require a per-session or per-request CSRF token that is bound to the user and not predictable.
- Restricting sensitive actions to well-defined HTTP methods and avoiding state changes via GET requests.
- Applying principle of least privilege so that compromised user accounts cannot perform high-impact administrative changes without additional verification (e.g., re-authentication or step-up checks).
- Considering the addition of defense-in-depth mechanisms such as same-site cookies, origin/referrer checks for critical endpoints, and explicit confirmation flows for high-risk actions.
How teams detect issues like this
Organizations can detect CSRF weaknesses through a combination of code analysis, testing, and policy enforcement:
- Reviewing route and controller definitions to verify that CSRF middleware or equivalent protection is consistently applied to state-changing endpoints.
- Using static analysis rules that flag missing CSRF checks on POST/PUT/DELETE routes or identify disabled security middleware.
- Incorporating security-focused code review checklists that call out any exceptions to global CSRF protection or custom bypass logic.
- Running automated dynamic tests or security scanners capable of generating cross-site requests and observing whether actions succeed without a valid CSRF token.
- Enforcing framework-level policies within CI/CD pipelines that disallow removing or bypassing standard CSRF protections without documented justification and compensating controls.
Organizations can detect CSRF weaknesses through a combination of code analysis, testing, and policy enforcement:
- Reviewing route and controller definitions to verify that CSRF middleware or equivalent protection is consistently applied to state-changing endpoints.
- Using static analysis rules that flag missing CSRF checks on POST/PUT/DELETE routes or identify disabled security middleware.
- Incorporating security-focused code review checklists that call out any exceptions to global CSRF protection or custom bypass logic.
- Running automated dynamic tests or security scanners capable of generating cross-site requests and observing whether actions succeed without a valid CSRF token.
- Enforcing framework-level policies within CI/CD pipelines that disallow removing or bypassing standard CSRF protections without documented justification and compensating controls.
