diskover-community — CSRF Leading to Authentication Bypass (CVE-2026-38934)

Metadata

Affected Target

Summary

public/settings_process.php in diskover-community (<= 2.3.5) accepts sensitive configuration-changing POST requests without validating any CSRF token. An attacker can craft a self-submitting HTML form that, when opened by an authenticated administrator, silently sets LOGIN_REQUIRED=false and other settings, disabling authentication for the entire application. Once authentication is disabled, the attacker gains unrestricted access to the diskover dashboard and its underlying Elasticsearch-backed data.

Vulnerability Details

Root Cause

settings_process.php performs no CSRF token generation or validation on state-changing POST requests, allowing cross-site requests to modify application settings (CWE-352).

Attack Vector

1. Attacker crafts an HTML page containing an auto-submitting form targeting http://TARGET/settings_process.php with LOGIN_REQUIRED=false and other configuration fields.
2. An authenticated administrator (or any browser with a live session/reachable endpoint) opens the malicious page.
3. The browser auto-submits the form, and the server accepts the settings change with no CSRF check.
4. The application subsequently allows unauthenticated access, e.g. GET /dashboard.php succeeds without login.

Impact

Complete authentication bypass, unauthorized access to the full application and Elasticsearch-backed index data, and potential mass deletion of indices; chainable with XSS for automated exploitation.

Environment / Lab Setup

Target:   diskover-community <= 2.3.5
Attacker: any web browser, or curl with a valid session cookie

Proof of Concept

PoC Script

See csrf_poc.html (browser-based CSRF trigger) and writeup.md (full technical write-up with curl reproduction) in this folder.

1
2
3
4

curl -s -b cookies.txt -X POST http://TARGET/settings_process.php \
  -d "formname=webotherform" -d "TIMEZONE=America/Vancouver" \
  -d "LOGIN_REQUIRED=false" -d "SEARCH_RESULTS=50" -d "SIZE_FIELD=size" \
  -d "MAX_INDEX=250" -d "INDEXINFO_CACHETIME=300" -d "NEWINDEX_CHECKTIME=30"

csrf_poc.html reproduces the “real-world” attack: hosting it and getting a victim admin session to open it auto-submits the same settings-tampering POST request via the browser, with no interaction beyond opening the page.

Detection & Indicators of Compromise

POST /settings_process.php HTTP/1.1

Signs of compromise:

• Unexpected changes to LOGIN_REQUIRED or other settings in diskover’s configuration
• settings_process.php requests originating from external Referer/Origin headers

Remediation

References

• Source repository

Notes

Mirrored from https://github.com/VadlaReddySai/diskoverdata-cve-writeups on 2026-07-05. The source repository covers multiple CVEs (CVE-2026-38934, CVE-2026-38935, CVE-2026-38936); only the CVE-2026-38934 write-up was mirrored per this batch’s assignment. csrf_poc.html was authored here to make the documented “real-world exploit” HTML snippet directly runnable.