CSRF on upvotes/downvotes about isso HOT 8 CLOSED

PoC:

<form id="target" method="POST"  action="http://isso.example.org/id/1/dislike">
  <input type="text" value="..." />
  <input type="submit"
 value="POST"/>
</form>

<script>
  $(document).ready(function() {
     $('#target').submit();
  });
</script>

from isso.

What's a common approach to harden a RESTful API against CSRF? Add an authentication token to a response, the client has to resent?

from isso.

Yes that's the idea, you want the attacker to be unable to forge this token so it has to be random (and don't set it as a cookie, otherwise the PoC would still work).

I didn't check but you might also want to check whether or not /activate and /delete are subject to the CSRF (especially because they can be triggered via GET so it'd be really easy to exploit it, no need for JS, a picture embedded in the markdown would be enough).

from isso.

Hi Alexis,

I made a patch which checks for HTTP-Origin to match the configured hosts. This is one recommended prevention for CSRF. The PoC from above no longer works. I'd love to get feedback from you.

Activation and deletion links are indeed only GET requests but sent via mail and hard to guess (cryptographically signed). I don't think they can be exploited with <img src="...">.

from isso.

I didn't know about Origin; but after a quick look at the Mozilla wiki you linked it should solve this issue [1]. Quick question though, how widely is this header supported? Because if a browser doesn't add it it will prevent the users of this browser to upvote/downvote comments (raise Forbidden would be triggered each time, right?).

Activation and deletion links are indeed only GET requests but sent via mail and hard to guess (cryptographically signed). I don't think they can be exploited with <img src="...">.

👍

[1] well there's still a theoretical attack as far as I can tell: if an attacker finds a XSS on the website using isso then that would allow the attacker to use the CSRF with the right origin.

from isso.

how widely is this header supported?

Not by IE10+, of course. Safari/Chrome and Firefox support this header since 2008.

from isso.

Separate fix for IE10 (see 9a03cca). The browser from Android 2.2 (and higher) supports the Origin header. Safari on iOS should support this header [citation needed].

from isso.

Implementation fails for Firefox.

from isso.