CSRF Vulnerability in Carbon Console by WSO2

CVE-2025-13394

What is CVE-2025-13394?

The Ajax processor within the Carbon console is vulnerable to Cross-Site Request Forgery (CSRF) attacks due to insufficient protection for state-changing operations. By using the HTTP GET method for these operations, the implementation exposes the system to attacks where an authenticated user's browser may inadvertently carry out unauthorized actions. The SameSite=Lax cookie attribute, although applied as a mitigation strategy, is ineffective against cross-origin top-level navigation that can include GET requests. This presents a risk where an attacker could manipulate authenticated sessions to perform unauthorized state-modifying requests, leading to potential data alteration or loss of user control over accounts. It is essential to note that this vulnerability may only be exploited if the Carbon console and its services are publicly accessible, which is discouraged by WSO2's security protocols.

References