Summary:
Several OTA update examples and the HTTPUpdateServer implementation in this repository are vulnerable to Cross-Site Request Forgery (CSRF). The update endpoints accept POST requests for firmware uploads without CSRF protection. This allows an attacker to upload and execute arbitrary firmware, resulting in remote code execution (RCE).

Impacted Source Files:

• libraries/Update/examples/OTAWebUpdater/OTAWebUpdater.ino
• libraries/WebServer/examples/WebUpdate/WebUpdate.ino
• libraries/HTTPUpdateServer/src/HTTPUpdateServer.h

Vulnerability Details:

• The firmware update endpoints (e.g., /update) do not implement CSRF protections such as anti-CSRF tokens or Origin/Referer header checks.
• In the provided examples, and by default in HTTPUpdateServer, the update endpoint may be unauthenticated or left unauthenticated by users following the examples.
• Even if authentication is enabled (e.g., via username and password), CSRF remains a risk: if a user is already logged in via their browser, a CSRF attack will still work because the browser will send the saved credentials (e.g., via cookies or HTTP auth) along with the forged request.
• An attacker can trick a user (who is on the same network as an ESP32 device running vulnerable code) into visiting a malicious website that silently uploads a malicious firmware image to the device’s update endpoint.

Attack Scenario:

1. The device is connected to a local network running any of the vulnerable examples or code.
2. A user who previously authenticated to the device's update endpoint visits a malicious website.
3. The site issues a POST request (with a malicious firmware image) to the device’s /update endpoint.
4. The browser automatically includes the user’s credentials, if any.
5. The device installs and runs the attacker’s firmware (RCE).

Impact:

• Remote code execution on affected ESP32 devices.
• Complete compromise of device integrity and functionality.
• Potential lateral movement within local networks.

Proof of Concept (PoC):
A minimal HTML page that exploits the vulnerability (user must be on the same network as the device):

<form id="csrf" action="http://<device-ip>/update" method="POST" enctype="multipart/form-data">
  <input type="file" name="update" />
  <input type="submit" value="Upload malicious firmware" />
</form>
<script>
  // To send automatically with a malicious payload, use fetch or submit via JS
</script>

Recommended Remediation:

• Require authentication for all update endpoints by default (username/password).
• Implement CSRF protection on all web forms (per-session random tokens, and/or Origin/Referer checks).
• Advise in documentation that authentication mitigates but does not eliminate CSRF risk—anti-CSRF measures are required even when authentication is used.

References:

• OWASP: Cross-Site Request Forgery (CSRF)
• OWASP: Firmware Defense