thorsten/phpmyfaq: CSRF Allows Unauthorized Elasticsearch/OpenSearch Index Operations

Summary

The Elasticsearch and OpenSearch administration API endpoints do not enforce CSRF protection for destructive and state-changing operations.

Affected actions include:

• POST /admin/api/elasticsearch/create
• POST /admin/api/elasticsearch/drop
• POST /admin/api/elasticsearch/import
• Corresponding OpenSearch endpoints

The endpoints only require the global CONFIGURATION_EDIT permission and do not validate a CSRF token.

Reproduction

Tested on phpMyFAQ 4.1.8.

An authenticated user with only CONFIGURATION_EDIT permission sent the following request without a CSRF token:

POST /admin/api/elasticsearch/drop HTTP/1.1
Host: localhost:8080
Cookie: PHPSESSID=<u_conf-session>
Content-Type: application/json

{}

The request passed the endpoint authorization checks and reached the Elasticsearch service initialization.

The test environment returned:

Fatal error: Undefined constant PMF_ELASTICSEARCH_TOKENIZER

because Elasticsearch was disabled/misconfigured in the test environment.

This confirms that the request reached the Elasticsearch operation without CSRF validation. In an environment with the service correctly configured, the requested operation would proceed to the corresponding Elasticsearch action.

Root Cause

Neither ElasticsearchController nor OpenSearchController performs Token::verifyToken() validation for the create(), drop(), or import() actions.

Impact

A malicious website may trigger these state-changing operations through the authenticated browser of a user with CONFIGURATION_EDIT permission.

Depending on the enabled backend and operation, this may allow:

• deletion of the search index;
• forced full FAQ re-indexing;
• resource exhaustion during large imports/re-indexing;
• disruption of search functionality.

Remediation

Require a valid page-scoped CSRF token for all state-changing actions in both controllers:

• create()
• drop()
• import()

The CSRF check should occur before invoking the Elasticsearch/OpenSearch service.