sheehan/grails-console

CSRF vulnerability, again

berdario opened this issue · 5 comments

berdario commented

I'm afraid that the issue hasn't been fixed properly. I realized it today after deploying your new release.

You can try: login (or simply visit in a barebone new grails application) the main app website, but DON'T visit the console. Trigger the poc I sent you the last time, and you'll see that it'll still work. After accessing the console the protection will be effective and the poc will stop working.

I suspect that the reason might be the request.getHeader('X-CSRFToken') != session['CONSOLE_CSRF_TOKEN']) check.

If the console hasn't been visited yet, there will be no CONSOLE_CSRF_TOKEN in the session, and thus both side of the equations will be null, letting the check pass.

berdario commented

Is there a reason why you haven't used the builtin protection offered by Grails, btw? That's not affected by this bug

sheehan commented

My bad. Will be fixed in the next version. withForm is for a single form submission from a gsp, the console plugin is doing many async calls from JavaScript.

berdario commented

Ok, thank you

Indeed, withForm is not a great name, but it only means that it expects the csrf tokens to be provided in the POST body (instead of via an header), as such you can use it just as well for xhr from Javascript

berdario commented

I added a small comment
1edba78#commitcomment-18519584

I see that you added a fix, but you haven't closed yet this issue... I gather that there's more that you want to fix?

sheehan commented

I was just waiting until i had time to release. Thanks for reporting the issue