Joomla! Issue Tracker | Joomla! CMS #36454 - [4.1 ScheduledTasks - Security] Scheduled Tasks can be run "now" by CSRF as no token.

No Code Attached Yet

Closed
2 Jan 2022
Medium
Build: 4.0-dev
# 36454

PhilETaylor
27 Dec 2021

Steps to reproduce the issue

Create a scheduled task. Note its ID.

Navigate in another tab to

http://example.com/administrator/index.php?option=com_ajax&format=json&plugin=RunSchedulerTest&group=system&id=6

where 6 is the ID of your task

Expected result

Task doesn't run as a GET request should be validated by CSRF Token before running anything other than "get"ing data.

Actual result

Task is run, regardless of its not a manual task.

{
  "success": true,
  "message": null,
  "messages": null,
  "data": {
    "status": 0,
    "taskStart": 1640646415.469952,
    "netDuration": 0.0005578994750976562,
    "taskEnd": 1640646415.47051,
    "logCategory": "task6",
    "plugin": "demotasks",
    "startTime": 1640646415.469984,
    "endTime": 1640646415.470506,
    "duration": 0.0005218982696533203
  }
}