CVE-2025-27910: Tianti_project Tianti CSRF Vulnerability

CVE-2025-27910 Overview

CVE-2025-27910 is a Cross-Site Request Forgery (CSRF) vulnerability in tianti v2.3, an open-source content management system. The flaw resides in the /user/ajax/upd/status endpoint, which does not validate the origin or authenticity of incoming requests. Attackers can craft malicious GET or POST requests to trigger arbitrary user status modifications when an authenticated victim visits a hostile page. The weakness maps to CWE-352: Cross-Site Request Forgery. Successful exploitation requires user interaction but yields high impact across confidentiality, integrity, and availability.

Critical Impact
An attacker can execute arbitrary administrative operations against tianti v2.3 by tricking an authenticated user into visiting a crafted page.

Affected Products

tianti v2.3
tianti_project tianti (CPE: cpe:2.3:a:tianti_project:tianti:2.3:*:*:*:*:*:*:*)
Component: /user/ajax/upd/status

Discovery Timeline

2025-03-10 - CVE-2025-27910 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-27910

Vulnerability Analysis

The vulnerability exists in the user status update handler exposed at /user/ajax/upd/status in tianti v2.3. The endpoint accepts state-changing requests without verifying an anti-CSRF token, custom header, or origin/referrer constraint. Because authentication state is carried by browser-managed session cookies, any cross-origin request issued while a user is logged in is processed as authentic.

A threat actor hosts a page containing a hidden form or <img> tag pointing at the vulnerable endpoint. When an authenticated tianti user, especially an administrator, loads the attacker-controlled page, the browser automatically attaches session credentials. The server then executes the embedded action with the victim's privileges. See the GitHub Issue Discussion for additional context.

Root Cause

The root cause is the absence of CSRF defenses on a state-changing endpoint. The handler accepts both GET and POST verbs, which broadens the attack surface and allows trivial exploitation through image tags and auto-submitting forms. No synchronizer token, double-submit cookie, or SameSite cookie enforcement is applied.

Attack Vector

Exploitation is network-based and requires a single user interaction: the victim visits an attacker-controlled URL while authenticated. An adversary can change account status fields, disable user accounts, or escalate privileges depending on the operation invoked, leading to account takeover or denial of service for legitimate users.

No verified public exploit code is available. Technical details remain documented in the upstream issue tracker.

Detection Methods for CVE-2025-27910

Indicators of Compromise

Unexpected status changes on user accounts in tianti audit logs without corresponding administrator login activity.
HTTP requests to /user/ajax/upd/status with Referer or Origin headers pointing to external domains.
Multiple status-update requests originating from a single session within a short timeframe.

Detection Strategies

Inspect web server access logs for GET requests to /user/ajax/upd/status, which is a strong signal of CSRF abuse since legitimate clients typically use POST.
Correlate browser Referer headers against the application's own domain and alert on mismatches.
Hunt for sequences where a tianti session cookie is used immediately after navigation from an untrusted external referrer.

Monitoring Recommendations

Enable verbose audit logging for all user management endpoints in tianti.
Forward web server and application logs to a centralized analytics platform for cross-session correlation.
Alert on bursts of user status modifications outside of normal administrative working hours.

How to Mitigate CVE-2025-27910

Immediate Actions Required

Restrict access to the tianti administrative interface to trusted networks or VPN-only segments until a fix is deployed.
Instruct administrators to log out of tianti when not actively using it and to avoid browsing untrusted sites in the same browser session.
Apply SameSite=Strict or SameSite=Lax attributes to tianti session cookies at the reverse proxy or application server layer.

Patch Information

No vendor patch is currently linked in the NVD entry. Track the upstream GitHub Issue Discussion for remediation status and apply any released update for tianti versions after 2.3 once available.

Workarounds

Deploy a Web Application Firewall (WAF) rule that blocks requests to /user/ajax/upd/status when the Origin or Referer header is missing or does not match the application host.
Reject GET method requests to state-changing endpoints at the reverse proxy.
Implement a synchronizer token pattern in a custom servlet filter applied to /user/ajax/* paths.

bash

# Example nginx rule to block cross-origin requests to the vulnerable endpoint
location /user/ajax/upd/status {
    if ($http_origin !~* ^https?://(www\.)?your-tianti-host\.example$) {
        return 403;
    }
    if ($request_method = GET) {
        return 405;
    }
    proxy_pass http://tianti_backend;
}