CVE-2025-13394: Carbon Console CSRF Vulnerability

CVE-2025-13394 Overview

CVE-2025-13394 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in the Ajax processor of the WSO2 Carbon console. The processor performs state-changing operations over HTTP GET requests. The SameSite=Lax cookie attribute intended to mitigate CSRF is bypassed because Lax permits cookies on top-level cross-origin navigations, including GET requests. An attacker can trick an authenticated user's browser into issuing unintended state-altering requests against the Carbon console.

Critical Impact
Exploitation can lead to unauthorized data modification, account changes, and loss of user control, but only when the Carbon console is exposed to the public internet, which WSO2 explicitly advises against.

Affected Products

WSO2 products that ship the Carbon console (see WSO2 Security Advisory WSO2-2025-4800)
Deployments where the Carbon console is reachable from untrusted networks
Authenticated administrative sessions to the Carbon console

Discovery Timeline

2026-08-06 - CVE-2025-13394 published to NVD
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2025-13394

Vulnerability Analysis

The Carbon console's Ajax processor accepts state-changing operations through HTTP GET requests. Web application design guidance requires GET to be safe and idempotent, with mutating operations routed through POST, PUT, or DELETE and protected by anti-CSRF tokens. The Carbon processor violates this contract and relies solely on the SameSite=Lax cookie attribute for cross-origin protection.

SameSite=Lax sends cookies on top-level navigations initiated by the user, including GET requests generated by clicking a link, submitting a form via GET, or loading a crafted URL. An attacker hosting a malicious page can trigger such a navigation while the victim holds an authenticated Carbon console session. The browser attaches the session cookie and the server executes the requested operation.

Root Cause

The root cause is missing CSRF protection [CWE-352] on state-changing endpoints combined with the use of GET for mutations. No synchronizer token, double-submit cookie, or origin header validation is enforced on the Ajax processor endpoints. SameSite=Lax is not a substitute for CSRF tokens on GET-based state changes.

Attack Vector

Exploitation requires an authenticated Carbon console user to visit or be redirected to an attacker-controlled page while the console is reachable across the network boundary between attacker and victim. The malicious page issues a top-level navigation, image request, or window redirect to a crafted Carbon console URL that invokes an administrative action. User interaction is required, and the attack is only feasible when the Carbon console is exposed beyond a trusted management network.

No verified proof-of-concept code is published. Refer to the WSO2 Security Advisory WSO2-2025-4800 for vendor-specific technical details.

Detection Methods for CVE-2025-13394

Indicators of Compromise

Carbon console access logs showing state-changing GET requests with Referer or Origin headers pointing to external domains
Administrative actions performed shortly after an authenticated user browsed to an untrusted site
Unexpected configuration, account, or tenant changes recorded in Carbon audit logs without a corresponding legitimate admin session

Detection Strategies

Alert on Carbon console mutating endpoints invoked via GET from cross-origin referers
Correlate web proxy egress logs with Carbon console request timestamps to identify browser-driven redirection to Carbon URLs
Baseline administrative activity per account and flag out-of-pattern configuration changes

Monitoring Recommendations

Forward Carbon console access and audit logs to a central SIEM for correlation with user browsing telemetry
Monitor perimeter and reverse-proxy logs for external requests reaching the Carbon console management interface
Track authentication events tied to administrative sessions and review any session that overlaps with browsing to untrusted domains

How to Mitigate CVE-2025-13394

Immediate Actions Required

Apply the fixes and version guidance published in WSO2 Security Advisory WSO2-2025-4800
Remove any public internet exposure of the Carbon console and restrict it to trusted management networks
Require administrators to use a dedicated browser or session for Carbon console access to reduce cross-site exposure

Patch Information

WSO2 has published remediation details in Security Advisory WSO2-2025-4800. Consult the advisory for the affected product versions and the corresponding updates or WUM/U2 patches. Apply the fixes to every environment that hosts the Carbon console, including non-production instances.

Workarounds

Place the Carbon console behind a VPN or bastion so it is not reachable from user browsers that also access untrusted content
Enforce network ACLs that permit only administrative source IP ranges to reach the Carbon console
Configure a reverse proxy to reject requests to Carbon console endpoints when the Origin or Referer header does not match the trusted management hostname

bash

# Example nginx snippet enforcing Origin/Referer on the Carbon console
location /carbon/ {
    if ($http_origin !~* "^https://carbon\.internal\.example\.com$") { return 403; }
    if ($http_referer !~* "^https://carbon\.internal\.example\.com/") { return 403; }
    proxy_pass https://wso2-backend;
}