[ 
https://issues.apache.org/jira/browse/JCR-4009?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15513104#comment-15513104
 ] 

Julian Reschke commented on JCR-4009:
-------------------------------------

trunk: [r1761909|http://svn.apache.org/r1761909] 
[r1758600|http://svn.apache.org/r1758600] 
[r1758597|http://svn.apache.org/r1758597]
2.12: [r1761911|http://svn.apache.org/r1761911] 
[r1758609|http://svn.apache.org/r1758609]
2.10: [r1761912|http://svn.apache.org/r1761912] 
[r1758761|http://svn.apache.org/r1758761]
2.8: [r1761913|http://svn.apache.org/r1761913] 
[r1758764|http://svn.apache.org/r1758764]
2.6: [r1761915|http://svn.apache.org/r1761915] 
[r1758771|http://svn.apache.org/r1758771]
2.4: [r1761916|http://svn.apache.org/r1761916] 
[r1758791|http://svn.apache.org/r1758791]

(the latest checkins fix a whitespace issue in the log message that was added 
as part of the actual fix) 

> CSRF in Jackrabbit-Webdav (CVE-2016-6801)
> -----------------------------------------
>
>                 Key: JCR-4009
>                 URL: https://issues.apache.org/jira/browse/JCR-4009
>             Project: Jackrabbit Content Repository
>          Issue Type: Bug
>          Components: jackrabbit-webdav
>    Affects Versions: 2.4.5, 2.6.5, 2.8.2, 2.10.3, 2.12.3, 2.13.2
>            Reporter: Julian Reschke
>            Assignee: Julian Reschke
>            Priority: Blocker
>              Labels: csrf, security, webdav
>             Fix For: 2.4.6, 2.6.6, 2.12.4, 2.10.4, 2.13.3, 2.8.3
>
>         Attachments: CVE-2016-6801.txt, JCR-4009.diff
>
>
> The changes for JCR-4002 have disabled CSRF checking for POST, and thus leave 
> the remoting servlet open for attacks. This HTML form below:
> {noformat}
> <form action="http://localhost:8080/server/default/jcr:root/"; method="post">
>     <input type="text" id="name" name="user_name" />
>     <button type="submit">Send your message</button>
>     </form>
> {noformat}
> will successfully cross-origin-POST to jackrabbit-standalone.
> While fixing this issue, it also became clear that the content-type check 
> failed to take syntax variations into account (upper/lowercase, optional 
> parameters)



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)

Reply via email to