CVE-2020-15400: 
PHP vulnerability analysis and mitigation

CakePHP versions before 4.0.6 contain a vulnerability in CSRF token generation (CVE-2020-15400). The vulnerability was discovered and reported by Nirmal Kirubakaran through the security mailing list. The issue was publicly disclosed on April 18, 2020, affecting CakePHP installations prior to version 4.0.6 (CakePHP Blog, CVE Mitre).

The vulnerability stems from improper handling of CSRF token generation in CakePHP's security middleware. The core issue involves the lack of HMAC signing with Security.salt in the token generation process, which could potentially allow token fixation under specific circumstances (CakePHP Blog).

If successfully exploited, this vulnerability could enable CSRF attacks when combined with XSS vulnerabilities or physical access to fixate a CSRF token. CSRF tokens generated in versions prior to 4.0.6 would be rejected by the patched version due to the absence of HMAC signing (CakePHP Blog).

The vulnerability is remotely exploitable when combined with XSS vulnerabilities. An attacker would need to successfully exploit an XSS vulnerability or have physical access to perform token fixation before executing CSRF attacks (CVE Mitre).

The vulnerability was addressed in CakePHP 4.0.6 by implementing HMAC signing of CSRF tokens using Security.salt. Users should upgrade to version 4.0.6 or later to receive the security fix. After upgrading, previously generated CSRF tokens will be invalidated as they lack the required HMAC signature (CakePHP Blog).