VULN-005-csrfable-logout-get.md

Affected Version:

• Invoice System in Laravel: 1.0

Vulnerability Information:

• Vulnerability Type: Cross-Site Request Forgery (CSRF) + Weak Session Handling
• Severity: MEDIUM
• Status: Unpatched

Vulnerable Endpoint:

• /logout (GET method)

Vulnerability Description:

The logout functionality is implemented as a GET request and does not require a CSRF token. This allows an attacker to force a victim to log out of the application by tricking them into clicking a link or loading a malicious image tag that points to the logout URL.

---

Proof of Concept (PoC):

Below is a GET request demonstrating forced logout:

GET /logout HTTP/1.1
Host: localhost

Explanation:

Because the logout action is triggered via a simple GET request:

GET /logout

An attacker can embed this URL in an <img> tag on a malicious site: <img src="http://target-app.com/logout">. When the victim visits the site, their session is terminated without their consent.

---

Impact:

• Availability: Interruption of the user's session and work.
• User Experience: Potential for annoyance and disruption of legitimate tasks.
• Security Logic: Logout should always be a protected state-change operation.

---

Mitigation Recommendations:

1. Use POST for Logout: Convert the logout route to a POST method.
2. CSRF Protection: Ensure the logout POST request includes a valid CSRF token.
3. Session Invalidation: Explicitly call Session::flush() and Auth::logout() in the controller.