CVE-2026-63000: Cross-Site Request Forgery in REDAXO CMS Package Update API

REDAXO is a modular, PHP-based content management system that relies on extensible addons. The core framework exposes a unified API routing mechanism to handle state-changing administrative operations, such as installation, removal, and modification of software packages. This centralized entry point is exposed via specific query parameters, making it a critical target for access control bypasses.

During a security audit of REDAXO versions preceding 5.21.2, researchers identified a structural flaw in the rex_api_install_package_update class. This class handles requests to update installed addons directly from the official package repository. Due to an architectural omission, the endpoint lacks validation for anti-CSRF (Cross-Site Request Forgery) tokens.

The security impact of this vulnerability is designated as CWE-352. An unauthenticated remote attacker can exploit this weakness by establishing a malicious site that forces a logged-in administrator's browser to execute requests against the vulnerability. This leads to silent package installations, application state modification, and potential service disruption without administrative consent.

The vulnerability stems from an insecure default-deny alternative, essentially an insecure opt-in model. In the REDAXO core architecture, API handlers are implemented as subclasses of the abstract base class rex_api_function. This base class governs core routing logic, access controls, and CSRF token verification.

Within the base class implementation of rex_api_function, the method requiresCsrfProtection() returns a boolean value of false by default. Under this design pattern, any new API endpoint created by developers is inherently unprotected against cross-origin state-changing attacks. To secure an endpoint, developers must explicitly override this method and return true within the subclass.

The endpoint responsible for updating packages, implemented in rex_api_install_package_update, omitted this override entirely. While sibling endpoints for package addition and deletion successfully implemented the override, the update handler inherited the insecure base default. Consequently, the core dispatcher bypasses token verification when processing update operations, leaving the endpoint fully exposed to CSRF vectors.

Analysis of the source file api_package_update.php prior to the release of version 5.21.2 confirms the omission. The class definition extends rex_api_function but defines only the execution logic. There is no structural representation or local validation of anti-CSRF nonces within the class scope.

The vulnerable code path contains only the execute() method, which performs verification on parameters like the package ID and file identifier before executing the update loop. Here is the structural layout of the vulnerable handler:

// Pre-patch structure in redaxo/src/addons/install/lib/api/api_package_update.php
class rex_api_install_package_update extends rex_api_function
{
    public function execute()
    {
        // Verify and extract parameters
        // No local check for CSRF token exists here.
        return new rex_api_result($success, $message);
    }
    // The requiresCsrfProtection method is entirely missing
}

To address this structural gap, the patch introduces the required method override. The updated class now explicitly declares its dependency on CSRF protection, forcing the core routing controller to validate tokens prior to invoking the execute() routine. The patched implementation is shown below:

// Patched structure in redaxo/src/addons/install/lib/api/api_package_update.php
class rex_api_install_package_update extends rex_api_function
{
    public function execute()
    {
        // Execution of the package update logic
        return new rex_api_result($success, $message);
    }
 
    // Explicit override to enforce CSRF token validation
    protected function requiresCsrfProtection()
    {
        return true;
    }
}

This implementation is architecturally complete for this specific endpoint. However, the reliance on an opt-in inheritance model for CSRF protection represents a persistent risk for custom third-party addons developed under the same framework. Developers must manually verify that all custom state-changing API subclasses correctly override the default behavior.

Exploiting the vulnerability requires two primary prerequisites. First, the attacker must identify a target website running an unpatched version of REDAXO. Second, the attacker must target an active, authenticated administrator who is concurrently logged into the REDAXO control panel within the same browser session.

The attacker constructs a malicious payload delivered via an HTML document. This document contains an invisible, self-submitting form targeting the REDAXO endpoint. Alternatively, the attacker can use a cross-origin asynchronous request (fetch API) if cross-origin resource sharing (CORS) configurations are permissive or to execute standard POST requests that do not require reading the response.

The conceptual layout of the attack path illustrates how the request flows from the victim's browser to the CMS backend. By executing the cross-origin request, the browser attaches the existing administrative session cookies automatically, bypassing the need for credentials.

Once the victim browser submits the request, the target application accepts the payload as a legitimate request from the active administrator. The REDAXO server then contacts the configured package server, downloads the requested addon version, and overwrites existing backend files on the local disk. This can lead to system instability or denial of service if breaking changes are applied to critical components.

The CVSS v3.1 base score for this vulnerability is rated at 6.4 (Medium Severity). The vector breakdown indicates network-based access (AV:N) with high complexity (AC:H) because the attack depends entirely on successful social engineering of an active administrator. No privileges are required on the target application to initiate the vector, but user interaction (UI:R) is mandatory.

The primary impact resides within the integrity of the system (I:H). By forcing package updates, an attacker can modify source code within the active backend directory. If the administrator has configured a custom or compromised repository mirror, or if an attacker can manipulate dns resolution or exploit upstream vulnerabilities in the package registry, this execution flow could be elevated to complete remote code execution (RCE).

The availability impact is rated as low (A:L). An unsolicited update can introduce backward-incompatible code, alter database schemas, or deactivate essential plugins, resulting in partial application downtime or administrative lockouts. Confidentiality impact is also rated as low (C:L) as direct state exposure to the external attacker is limited unless the updated package itself leaks configuration data.

The definitive remediation for CVE-2026-63000 is upgrading the REDAXO CMS installation to version 5.21.2 or higher. The release tag for this version was published on June 29, 2026, and incorporates the required class override. This patch successfully forces the system's router to validate the anti-CSRF token on every request targeting the update endpoint.

For deployments where an immediate version upgrade is not feasible, administrators can apply a manual hotfix. By editing the target class file at redaxo/src/addons/install/lib/api/api_package_update.php, developers can append the protected requiresCsrfProtection() method returning true. This hotfix matches the official commit patch exactly.

Security teams can detect vulnerable assets using signature-based tools or dynamic analysis. A custom Nuclei scanner can check the responsiveness of the endpoint without a token parameter. Additionally, the following Snort detection rule can identify potential exploitation attempts in transit over local network links:

alert tcp any any -> any 80 (msg:"REDAXO CMS Package Update CSRF Attempt"; content:"POST"; http_method; content:"rex-api-call=install_package_update"; http_client_body; sid:1000001; rev:1;)