GHSA-P2CH-C2C3-4XM5: Cross-Site Request Forgery in Winter CMS AJAX Routing

Winter CMS is an open-source, extensible content management system built on the Laravel framework.

The backend panel features an AJAX framework that facilitates asynchronous administrative actions. These actions are handled by specific controller methods, commonly referred to as AJAX handlers, which process administrative request payloads.

A routing mechanism flaw allows authenticated administrative AJAX handlers to be executed through standard HTTP GET requests. This route bypass exposes the application to cross-site request forgery attacks because the GET routing path bypasses the default CSRF protection middleware.

Because administrative users maintain broad permissions over layouts, database operations, and logs, the impact of unauthorized execution remains high.

The underlying vulnerability is located within the request-to-action routing engine of the Winter CMS backend controller class.

In PHP, method names are case-insensitive. When an administrator requests a path like /backend/system/eventlogs/index_onemptylog, the routing system verifies if the action exists in the controller using the actionExists verification method.

Because of PHP's case-insensitive method resolution, the lowercase URL string index_onemptylog successfully matches the mixed-case index_onEmptyLog method defined in the controller class.

Once matched, the framework dispatches the handler as a standard page action. Since standard HTTP GET requests do not trigger CSRF validation, the application processes the request and executes the administrative logic.

The vulnerability is resolved by modifying the verification mechanism in the base controller class to strictly enforce matching casing for URL segments.

The original code relied on PHP's default reflection check, which implicitly ignores case differences. The following patch was introduced to compare the declared case of the method with the requested action name:

// In modules/backend/classes/Controller.php
if ($ownMethod) {
    $methodInfo = new \ReflectionMethod($this, $name);
 
    /*
     * Only allow lowercase actions. Compare the resolved method name rather than the
     * requested one - PHP method names are case-insensitive, so a lowercased URL
     * segment would otherwise pass this check and still resolve to the mixed-case
     * method (eg. "index_onemptylog" reaching index_onEmptyLog()).
     */
    if (strtolower($methodInfo->getName()) !== $methodInfo->getName()) {
        return false;
    }
 
    $public = $methodInfo->isPublic();
    if ($public) {
        return true;
    }
}

Additionally, the framework modified the parser function in BackendController.php to prevent camel-case conversion of dashed URL parameters during normalization:

// In modules/backend/classes/BackendController.php
protected function parseAction($actionName)
{
    if (strpos($actionName, '-') !== false) {
        return snake_case(camel_case($actionName));
    }
 
    return $actionName;
}

An attack requires an active administrator session and user interaction with a malicious link or embedded asset.

To perform the attack, an adversary constructs a URL targeting a sensitive AJAX handler, such as index_onEmptyLog inside the EventLogs controller, using its lowercased equivalent: index_onemptylog.

The adversary embeds this target URL within a malicious page or document. When the logged-in administrator visits the page, the browser automatically executes an authenticated GET request.

Because the request uses the GET method, CSRF defense mechanisms are not invoked. The application routes the call to the targeted handler, executing administrative functions without consent.

Successful exploitation allows cross-site request forgery attacks to execute arbitrary, highly privileged operations.

Attackers can achieve unauthorized data modifications such as deleting content management templates, truncating crucial logs, or disabling critical system settings.

The unofficial CVSS version 3.1 score is evaluated at 8.8 (High). This reflects the high impact on integrity and availability, combined with the requirement for user interaction.

Administrators must upgrade Winter CMS installations to version 1.2.14 or later immediately.

To update the dependency via composer, execute composer update wintercms/winter.

Detection of exploitation attempts can be achieved by monitoring web access logs for GET requests containing strings such as index_on or other common handler suffixes.

A Web Application Firewall (WAF) rule can be configured to block GET requests matching known AJAX handler signatures on the backend paths.