CyberRota Analysis
AI-GeneratedHubzilla 11.2.1 is vulnerable to a cross-site request forgery (CSRF) in the OAuth2 /authorize endpoint, allowing unauthenticated attackers to register malicious OAuth2 applications under an authenticated user's account. This vulnerability can lead to unauthorized interception of OAuth2 authorization codes, posing a risk to user data and account security. Organizations using Hubzilla should prioritize patching this vulnerability to protect their users from potential exploitation.
Original NVD Description
Hubzilla versions prior to 11.4 contains a cross-site request forgery vulnerability in the OAuth2 /authorize endpoint handled by Zotlabs\Module\Authorize::post() that allows unauthenticated attackers to register arbitrary OAuth2 applications under an authenticated user's account by submitting a cross-origin POST request without CSRF token or Origin/Referer validation. Attackers can craft a malicious HTML form that autosubmits attacker-chosen OAuth2 parameters including client_id, client_secret, redirect_uri, and scope to silently register a persistent OAuth2 application, enabling interception of future OAuth2 authorization codes when the victim later authenticates against the attacker-controlled client.