CVE-2025-5410: Mist Community Edition CSRF Vulnerability

CVE-2025-5410 Overview

CVE-2025-5410 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] affecting Mist Community Edition up to version 4.7.1. The flaw resides in the session_start_response function within src/mist/api/auth/middleware.py. The session cookie was issued without a SameSite attribute, allowing cross-origin requests to carry the authenticated session and trigger privileged actions such as the administrator su operation. The attack is network-based and requires user interaction, such as visiting an attacker-controlled page while authenticated. Upstream commit db10ecb62ac832c1ed4924556d167efb9bc07fad addresses the issue, and Mist Community Edition 4.7.2 contains the fix.

Critical Impact
An attacker can leverage an authenticated user's browser session to execute unauthorized state-changing requests, including privileged administrative operations.

Affected Products

Mist Community Edition versions up to and including 4.7.1
Component: src/mist/api/auth/middleware.py (session_start_response)
Fixed in: Mist Community Edition 4.7.2

Discovery Timeline

2025-06-01 - CVE-2025-5410 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-5410

Vulnerability Analysis

Mist Community Edition is an open-source multi-cloud management platform. The session_start_response middleware issues session cookies to authenticated users. Prior to version 4.7.2, the Set-Cookie header emitted by this middleware included only the Path attribute and omitted the SameSite attribute. Modern browsers default to SameSite=Lax for many navigation contexts, but that default does not consistently block cross-origin requests capable of state-changing operations, particularly those triggered through form submissions or embedded resources targeting sensitive endpoints.

An attacker who lures an authenticated Mist user to a malicious page can issue cross-origin requests that carry the user's session.id cookie. The disclosed proof-of-concept targets the administrator su operation, which impersonates other accounts and provides an escalation path within a Mist deployment.

Root Cause

The session cookie construction in session_start_response did not include the SameSite=Strict flag. Without a restrictive SameSite policy, the browser attaches the session cookie to cross-site requests, satisfying server-side authentication checks for requests initiated by an attacker.

Attack Vector

Exploitation requires an authenticated Mist user to interact with attacker-controlled content, such as visiting a crafted webpage or clicking a malicious link. No credentials or elevated privileges are needed by the attacker. The request is executed with the victim's session, and impact is limited to actions the victim is authorized to perform, including administrative su if the victim holds that role.

python

# Patch: src/mist/api/auth/middleware.py
# Source: https://github.com/mistio/mist.api/commit/db10ecb62ac832c1ed4924556d167efb9bc07fad
            if isinstance(session, SessionToken) and \
                    not getattr(session, 'internal', False) and \
                    not session.last_accessed_at:
-               cookie = 'session.id=%s; Path=/;' % session.token
+               # (CSRF) Security Fix: Added SameSite=Strict flag to prevent CSRF attack
+               # in admin's "su" operation. In case of having a cookie issue, consider
+               # removing and addressing the CSRF issue in another way
+               cookie = 'session.id=%s; Path=/; SameSite=Strict;' % session.token
                headers.append(('Set-Cookie', cookie))

The patch adds SameSite=Strict to the session cookie, instructing browsers to withhold the cookie on cross-site requests. See the upstream commit for the full diff.

Detection Methods for CVE-2025-5410

Indicators of Compromise

HTTP requests to sensitive Mist API endpoints containing a Referer or Origin header pointing to an untrusted external domain while carrying a valid session.id cookie.
Unexpected use of the administrator su (impersonation) operation, particularly from browser user agents outside normal administrator workflows.
Session cookies issued by pre-4.7.2 Mist deployments that lack the SameSite attribute.

Detection Strategies

Inspect reverse-proxy or web-server logs for state-changing requests to mist.api endpoints where the Origin or Referer does not match the Mist deployment's canonical hostname.
Correlate authentication and session events with administrative actions to identify impersonation activity triggered shortly after a user visited an external URL.
Compare deployed Mist Community Edition version against the fixed release v4.7.2 to identify vulnerable instances.

Monitoring Recommendations

Enable detailed audit logging for Mist administrative actions, including su, org membership changes, and token issuance.
Alert on session cookies observed in HTTP responses that do not include a SameSite attribute for the Mist domain.
Monitor for spikes in authenticated requests originating from atypical Referer values against Mist API routes.

How to Mitigate CVE-2025-5410

Immediate Actions Required

Upgrade Mist Community Edition to version 4.7.2 or later, which includes commit db10ecb62ac832c1ed4924556d167efb9bc07fad.
Invalidate existing sessions after upgrade to force reissuance of cookies with the SameSite=Strict attribute.
Review recent administrative actions, especially su operations, for signs of abuse prior to patching.

Patch Information

The fix is available in Mist Community Edition v4.7.2 release notes. The commit db10ecb62ac832c1ed4924556d167efb9bc07fad adds SameSite=Strict to the session cookie emitted by session_start_response. A public proof-of-concept is published in the Stolichnayer/mist-ce-csrf repository.

Workarounds

If immediate upgrade is not possible, place Mist behind a reverse proxy that rewrites the Set-Cookie header for session.id to append SameSite=Strict; Secure.
Restrict administrative access to trusted networks or VPNs so that CSRF requests originating from arbitrary user browsers cannot reach privileged endpoints.
Advise administrators to use isolated browser profiles for Mist and log out immediately after administrative tasks.

bash

# Example NGINX directive to enforce SameSite on the Mist session cookie
proxy_cookie_path / "/; SameSite=Strict; Secure; HttpOnly";