A critical Cross-Site Request Forgery vulnerability in RedwoodJS SDK allows remote, unauthenticated attackers to execute unauthorized state-changing actions via GET requests.

The framework fails to properly restrict HTTP methods for exported server functions, allowing state-changing operations intended for POST requests to be triggered via GET. Because browsers include cookies with top-level GET requests, an unauthenticated attacker can force a user's browser to execute sensitive server-side functions without the user's consent.

This vulnerability poses a significant risk to data integrity and system state. Successful exploitation allows an attacker to perform unauthorized actions on behalf of a victim, potentially leading to unauthorized data modification, account manipulation, or other state-changing operations within the application. Given the CVSS score of 8.1, the risk is considered high due to the potential for significant impact on system integrity and availability.

Immediate Action: Update the RedwoodJS SDK dependency to version 1.0.6 or later immediately to incorporate the necessary HTTP method enforcement.

Proactive Monitoring: Review application access logs for suspicious GET requests targeting endpoints typically reserved for state-changing operations or server actions.

Compensating Controls: Implement strict CSRF protection tokens and verify origin headers on all sensitive server functions to ensure that requests originate from trusted sources.

Public Exploit Available: Yes, a public proof-of-concept exists on GitHub.

The severity of this flaw necessitates an immediate update to the patched version of the SDK. Organizations utilizing RedwoodJS should prioritize this remediation to prevent unauthorized state manipulation and protect user sessions from cross-site request forgery attacks.