You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@jackrabbit.apache.org by "Julian Reschke (JIRA)" <ji...@apache.org> on 2016/11/10 09:13:58 UTC
[jira] [Updated] (JCR-4009) CSRF in Jackrabbit-Webdav
(CVE-2016-6801)
[ https://issues.apache.org/jira/browse/JCR-4009?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Julian Reschke updated JCR-4009:
--------------------------------
Fix Version/s: 2.14
> CSRF in Jackrabbit-Webdav (CVE-2016-6801)
> -----------------------------------------
>
> Key: JCR-4009
> URL: https://issues.apache.org/jira/browse/JCR-4009
> Project: Jackrabbit Content Repository
> Issue Type: Bug
> Components: jackrabbit-webdav
> Affects Versions: 2.4.5, 2.6.5, 2.8.2, 2.10.3, 2.12.3, 2.13.2
> Reporter: Julian Reschke
> Assignee: Julian Reschke
> Priority: Blocker
> Labels: csrf, security, webdav
> Fix For: 2.4.6, 2.6.6, 2.12.4, 2.10.4, 2.13.3, 2.8.3, 2.14
>
> Attachments: CVE-2016-6801.txt, JCR-4009.diff
>
>
> The changes for JCR-4002 have disabled CSRF checking for POST, and thus leave the remoting servlet open for attacks. This HTML form below:
> {noformat}
> <form action="http://localhost:8080/server/default/jcr:root/" method="post">
> <input type="text" id="name" name="user_name" />
> <button type="submit">Send your message</button>
> </form>
> {noformat}
> will successfully cross-origin-POST to jackrabbit-standalone.
> While fixing this issue, it also became clear that the content-type check failed to take syntax variations into account (upper/lowercase, optional parameters)
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)