[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6},"actionData","errors","routes/hashtag",{"_7":8,"_9":10,"_11":12},"articles",[13],"authors",{},"tag","csrf",{"_14":15,"_16":17,"_18":19,"_20":21,"_22":23,"_24":25,"_26":27},"content","**NOTE**: originally posted on [snotra.cloud](https://snotra.cloud/blog) in Jan 2025.\n\nI recently purchased the Bitaxe Gamma Bitcoin Miner “Black Edition” from the [TheSoloMiningCo](https://www.thesolomining.co/shop/product/bitaxe-gamma-v601-bm1370-bitcoin-miner-black-edition/). Bitaxe is a fully open source Bitcoin ASIC miner aimed at decentralizing mining. I bought this little inexpensive miner to learn more about mining, and experiment with Stratum, Datum and the [Ocean Mining Pool](https://www.ocean.xyz/). At the moment I have pointed my BitAxe at the [Public Pool](https://web.public-pool.io/#/)which is a solo mining pool which, although infinitesimal, gives me a change of mining a BLock and obtaining the full block reward.\n\nAnyway, whilst configuring the miner via the web interface I noticed the settings form has no form of authentication or apparent CSRF protections.\n\n\n ![image](https://image.nostr.build/30167567e6aef9c59a4591cd91088bce9a5bcfaecf775799455226c4da734e8e.jpg)\n\nThe BitAxe has a wireless adapter and will typically be run on users LAN or Home network. This means any user on the same network that visits a website hosting the CSRF code will inadvertently update settings on their Bitaxe to values controlled by an attacker. These settings include the Stratum user which contains the BTC address any payouts are sent to.\n\nI have crated a proof of concept:\n\n\n```\n\n \n \n

Bitaxe CSRF POC

\n \n\n\n```\n\n\nIf you have a BitAxe that is connected to your LAN in either the 192.168.1.0/24 or 192.168.0.1/24 range visiting a site hosting the above code will result in your Bitaxe restarting and the Stratum username being updated to \"bc1qhztuw3zmjuseqda9w600fcvany55deky26krer.csrf\". Thereafter any rewards you might get for mining will be paid to my BTC address.\n\nAll fields of the settings page are affected, it would also be possible to change the frequency and voltage settings for example and potentially damage the hardware or even upload malicious firmware perhaps (not tested).\n\nAdditionally, the web server sets the following CORS headers\n\n```\nAccess-Control-Allow-Origin: *\nAccess-Control-Allow-Methods: GET, POST, PUT, PATCH, DELETE, OPTIONS\nAccess-Control-Allow-Headers: Content-Type\n```\nThis means an attacker can also read values from the API and exfiltrate them to an external server. Although a quick look over the API didn't turn up any sensitive information that would be cause a signifiant impact if stolen.\n\nTo mitigate this, in lieu of a fix and website update, you could stick your BitAxe on a guest network segmented from other devices on which you usually do browsing and would encounter an active exploit attempt. \n\nI have reported the issue on [GiHub](https://github.com/skot/ESP-Miner/issues/630) and i am awaiting a response.\n\nDespite this, I do highly recommend you purchase one of these cool little miners, especially the \"Black Edition\" from [TheSoloMiningCo](https://www.thesolomining.co/shop/product/bitaxe-gamma-v601-bm1370-bitcoin-miner-black-edition/>).\n\n**update**:\nKudos to Skot and the guys behind BitAxe a fix was pushed out super quick and I also got the CVE `CVE-2025-27579 `_ assigned.\n","created_at",1771879832,"id","8848f26a38c2305dc9db0800f4b9a81dbba99d9fa68395b5b7ce92d90c6d182b","kind",30023,"pubkey","889b19eb43ef98e35c59e655b5c67dc11b90650bab6d1421d075aefbff45973f","sig","579967ef246eb3084d8974d3db770aac9557aa80f1baa8bd38642ae014d1cf5b7afe1d5507d0e0be2199ce00b055d9be3910fedc5544229ea6060d96450d221b","tags",[28,29,30,31,32,33,34,35,36,37],[52,53,54],[50,51],[48,49],[46,47],[44,45],[42,43],[38,41],[38,40],[38,12],[38,39],"t","Cybersecurity","Bitcoin","BitAxe","summary","Using a CSRF Attack to update the Payout Address on BitAxe Bitcoin Miners","title","AxeOS CSRF Vulnerability","image","https://image.nostr.build/e4ee213fb3122b1cdabf2042da03f9c3b8d023a5cff5d113a8f2487364bb0757.jpg","d","MV66KBG4gJJAubemQDuus","published_at","1771879832","client","Yakihonne","31990:20986fb83e775d96d188ca5c9df10ce6d613e0eb7e5768a0f0b12b37cdac21b3:1700732875747"]