Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

smicallef/spiderfoot

              master @ 0f815a2
            

Fixes

CVEs

MEDIUM

Peak severity

Highlights

CSRF: 2 prior fixes. Scrutinize any change in this area.

sfwebui.py: most-fixed (2 issues). Treat as high-risk during review.

0 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

CSRF: The configuration save endpoint was susceptible to CSRF attacks, allowing malicious sites to alter SpiderFoot settings on behalf of authenticated users. This was addressed by implementing server-side validation of a random CSRF token.

CSRF: The client-side settings form lacked CSRF tokens, preventing the UI from transmitting the required token for validation. Adding the hidden token input field resolved this omission.

Reflected XSS: The application dynamically rendered unvalidated scan ID parameters in error responses, leading to Reflected XSS. The fix introduced validation to ensure the scan ID exists in the database before rendering.