[jira] [Updated] (STORM-460) CSRF vulnerability in storm UI

["Rick Kellogg (JIRA)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/STORM-460?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Rick Kellogg updated STORM-460:
-------------------------------
    Component/s: storm-core

> CSRF vulnerability in storm UI
> ------------------------------
>
>                 Key: STORM-460
>                 URL: https://issues.apache.org/jira/browse/STORM-460
>             Project: Apache Storm
>          Issue Type: Bug
>          Components: storm-core
>    Affects Versions: 0.10.0
>            Reporter: Parth Brahmbhatt
>            Assignee: Parth Brahmbhatt
>              Labels: security
>             Fix For: 0.10.0
>
>
>  If you are already kerberized and visit a webpage that malliciosly posts this request
> http://storm-ui-root/api/v1/topology/storm-6-1406915499/kill/30
> it will end up killing a topology with id storm-6-1406915499. 
> To reproduce the issue, open storm ui in secure or non secure mode once using any browser. You can then close the storm ui tab. Usig chrome https://chrome.google.com/webstore/detail/postman-rest-client/fdmmgilgnpjigdojojpjoooidkmcomcm or curl post this request 
> http://<storm-ui-root>/api/v1/topology/<your topology id>/kill/30
> It should end up killing the topology.
> See http://en.wikipedia.org/wiki/Cross-site_request_forgery to understand CSRF vulenrability.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)