You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@sling.apache.org by "Sonal Gupta (Jira)" <ji...@apache.org> on 2020/02/04 10:11:00 UTC
[jira] [Commented] (SLING-9043) COPY should be in the referer
filter's default list of protected HTTP methods
[ https://issues.apache.org/jira/browse/SLING-9043?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17029716#comment-17029716 ]
Sonal Gupta commented on SLING-9043:
------------------------------------
[~reschke] Yes, i have tested that if referrer is empty/not specified then Forbidden error appears as empty referrer is not allowed by default.
[https://github.com/apache/sling-org-apache-sling-security/blob/master/src/main/java/org/apache/sling/security/impl/ReferrerFilter.java#L107]
Commands used:
{quote}curl 'http://localhost:8081/crx/server/crx.default/jcr%3aroot/etc/commerce' -X COPY -H 'Connection: keep-alive' -H 'Pragma: no-cache' -H 'Cache-Control: no-cache' -H 'X-Requested-With: XMLHttpRequest' -H 'Overwrite: T' -H 'Destination: /crx/server/crx.default/jcr%3aroot/apps/commerce' -H 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36' -H 'Accept: */*' -H 'Origin: http://localhost:8081' -H 'Sec-Fetch-Site: same-origin' -H 'Sec-Fetch-Mode: cors' -H 'Referer:' -H 'Accept-Encoding: gzip, deflate, br' -H 'Accept-Language: en-US,en;q=0.9' -u "admin:admin" --compressed -I
{quote}
{quote}curl 'http://localhost:8081/crx/server/crx.default/jcr%3aroot/etc/commerce' -X COPY -H 'Connection: keep-alive' -H 'Pragma: no-cache' -H 'Cache-Control: no-cache' -H 'X-Requested-With: XMLHttpRequest' -H 'Overwrite: T' -H 'Destination: /crx/server/crx.default/jcr%3aroot/apps/commerce' -H 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36' -H 'Accept: */*' -H 'Origin: http://localhost:8081' -H 'Sec-Fetch-Site: same-origin' -H 'Sec-Fetch-Mode: cors' -H 'Accept-Encoding: gzip, deflate, br' -H 'Accept-Language: en-US,en;q=0.9' -u "admin:admin" --compressed -I
{quote}
> COPY should be in the referer filter's default list of protected HTTP methods
> -----------------------------------------------------------------------------
>
> Key: SLING-9043
> URL: https://issues.apache.org/jira/browse/SLING-9043
> Project: Sling
> Issue Type: Bug
> Components: Resource Access Security
> Reporter: Sonal Gupta
> Priority: Major
> Labels: vulnerability
>
> The COPY method , by default, is not in the list of methods covered by the CSRF Referer filter. This might allow an attacker to copy files (abusing the privileges of a logged in victim) using CSRF.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)