MultiJuicer, used to run Juice Shop instances centrally, has a CSRF vulnerability in the team join endpoint (POST /multi-juicer/api/teams/{team}/join) in versions 8.0.0 through 10.0.0. The endpoint accepts any Content-Type, including text/plain, which does not trigger CORS preflight requests. An attacker can exploit this by hosting a cross-site HTML form that auto-submits to the endpoint, causing the victim's browser to join the attacker's team without authentication. This allows attackers to manipulate CTF scores and intercept sensitive data entered by victims. The vulnerability is exploitable without prior authentication and is not mitigated by SameSite=Strict cookies because the attack plants a new cookie. The issue was fixed in version 10.0.1.

An attacker can cause victims to unknowingly join the attacker's team in the MultiJuicer deployment, enabling the attacker to inflate their team's score using the victim's activity and capture sensitive data entered by the victim. This undermines the integrity of CTF scoring and compromises data confidentiality within the Juice Shop instances. The attack requires only that the victim visit an attacker-controlled webpage while having network access to the MultiJuicer service. There is no impact on confidentiality of existing sessions, but the attack can plant new session cookies.

This vulnerability was fixed in MultiJuicer version 10.0.1. Users should upgrade to version 10.0.1 or later to remediate this issue. No other mitigation or temporary fix is documented. Patch status is confirmed by the vendor fix in 10.0.1.