Multi Juicer
Monthly
Cross-site request forgery in MultiJuicer allows an attacker to force a victim's browser to join the attacker's team via the team join endpoint (POST /multi-juicer/api/teams/{team}/join). The endpoint accepts requests with any Content-Type, and text/plain does not trigger a CORS preflight, enabling cross-site form submissions. A victim visiting an attacker-controlled page unwittingly joins the attacker's team, so their challenge solves and any sensitive data entered in their Juice Shop instance are credited to the attacker. Public exploit code exists (SSVC: poc), but no active exploitation has been reported and EPSS probability is low (0.17%). Fixed in version 10.0.1.
Cross-site request forgery in MultiJuicer allows an attacker to force a victim's browser to join the attacker's team via the team join endpoint (POST /multi-juicer/api/teams/{team}/join). The endpoint accepts requests with any Content-Type, and text/plain does not trigger a CORS preflight, enabling cross-site form submissions. A victim visiting an attacker-controlled page unwittingly joins the attacker's team, so their challenge solves and any sensitive data entered in their Juice Shop instance are credited to the attacker. Public exploit code exists (SSVC: poc), but no active exploitation has been reported and EPSS probability is low (0.17%). Fixed in version 10.0.1.