[jira] [Created] (JCR-3909) CSRF bug in Jackrabbit-Webdav

["Mikhail Egorov (JIRA)" <ji...@apache.org>]

Mikhail Egorov created JCR-3909:
-----------------------------------

             Summary: CSRF bug in Jackrabbit-Webdav
                 Key: JCR-3909
                 URL: https://issues.apache.org/jira/browse/JCR-3909
             Project: Jackrabbit Content Repository
          Issue Type: Bug
          Components: jackrabbit-webdav
    Affects Versions: 2.11.0
            Reporter: Mikhail Egorov
             Fix For: 2.11.1


Following issues lead to CSRF:
1.Jackrabbit-webdav process POST requests as PUT requests. Handler doPost invokes doPut in code of org.apache.jackrabbit.webdav.server.AbstractWebdavServlet class.

2.There is CSRF protection based on Referer header - https://issues.apache.org/jira/browse/JCR-3036. This protection could be bypassed, because it allows requests with omitted Referer header. It is possible to strip referer by creating an iframe with Javascript in src attribute. It works beacuse javascript is executed in context of about:blank page.

Attack scenario:
1. Attacker creates following HTML page:
<h1>CSRF PoC</h1>
<iframe src="javascript:document.write('<form method=post enctype=\'text/plain\' action=\'http://127.0.0.1:8080/jackrabbit-webapp-custom/repository/default/evil\'><input type=\'hidden\' name=\'EvilContent\'/></form>');document.forms[0].submit();"></iframe>

2. If victim previously used browser to access jackrabbit-webdav and open attacker's page than node "evil" with content "EvilContent=" will be created on victim's behalf.

Proposed fix:
Jackrabbit-webdav should return 405 Method Not Allowed for POST requests by default. When POST requests are requried robust CSRF protection must be implemented. At least omitted Referer should be prohibited for POST requests. Referer based protection considered weak, because it is possible to completely bypass Referer-based protection for IE browser using Java Applets or PDF files. The best option for CSRF protection is CSRF tokens.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)