GHSA-whrh-9j4q-g7ph: 
JavaScript vulnerability analysis and mitigation

A Cross-Site Request Forgery (CSRF) vulnerability was discovered in polaris-website package versions below 1.1.1. The vulnerability was published on August 2, 2020, and disclosed on August 5, 2020. This security issue affects the Polaris website and panel designed to work with the Polaris bot (GitHub Advisory).

The vulnerability has a CVSS v3.1 base score of 6.8 (Moderate severity), with the following metrics: Network attack vector, High attack complexity, No privileges required, User interaction required, Unchanged scope, and High impact on both confidentiality and integrity. The vulnerability is tracked as GHSA-whrh-9j4q-g7ph and is classified under CWE-352 (GitHub Advisory, Snyk Report).

Under specific circumstances, an attacker could exploit this vulnerability to update user settings without their knowledge or consent. The attack scenario requires the victim to be logged into the panel while navigating to a malicious site. While the attacker could modify settings, they would not be able to verify the success of the attack or read the existing settings (GitHub Advisory).

The vulnerability requires specific conditions to be exploited: the victim must be authenticated to the application and must be tricked into visiting a malicious website while maintaining an active session. The attack complexity is considered high due to these prerequisites (Snyk Report).

The vulnerability was patched in version 1.1.1 by implementing the Double Submit Cookie Pattern. This security measure involves sending a random value in both a cookie and as a request parameter, with the server verifying if the cookie value and request value are equal. Users are advised to upgrade to version 1.1.1 or higher to protect against this vulnerability (GitHub Advisory, Double Submit Pattern).