[
https://issues.apache.org/jira/browse/SLING-9043?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17027311#comment-17027311
]
Sonal Gupta commented on SLING-9043:
------------------------------------
[~reschke] COPY command works perfectly fine with both valid/in-valid referrers
and request passes. This might allow an attacker to copy files (abusing the
privileges of a logged in victim) using CSRF. On adding COPY in referrer
filter list, 403 Forbidden error occurs on using invalid referrer.
curl 'http://localhost:8082/crx/server/crx.default/jcr%3aroot/etc/commerce' -X
COPY -H 'Connection: keep-alive' -H 'Pragma: no-cache' -H 'Cache-Control:
no-cache' -H 'X-Requested-With: XMLHttpRequest' -H 'Overwrite: T' -H
'Destination: /crx/server/crx.default/jcr%3aroot/apps/commerce' -H 'User-Agent:
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like
Gecko) Chrome/79.0.3945.130 Safari/537.36' -H 'Accept: */*' -H 'Origin:
[http://localhost:8082|http://localhost:8082/]' -H 'Sec-Fetch-Site:
same-origin' -H 'Sec-Fetch-Mode: cors' -H 'Referer:
[http://localhost:8082/crx/de/index.jsp]' -H 'Accept-Encoding: gzip, deflate,
br' -H 'Accept-Language: en-US,en;q=0.9' -u "admin:admin" --compressed -I
curl 'http://localhost:8082/crx/server/crx.default/jcr%3aroot/etc/commerce' -X
COPY -H 'Connection: keep-alive' -H 'Pragma: no-cache' -H 'Cache-Control:
no-cache' -H 'X-Requested-With: XMLHttpRequest' -H 'Overwrite: T' -H
'Destination: /crx/server/crx.default/jcr%3aroot/apps/commerce' -H 'User-Agent:
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like
Gecko) Chrome/79.0.3945.130 Safari/537.36' -H 'Accept: */*' -H 'Origin:
[http://www.google.com|http://www.google.com/]' -H 'Sec-Fetch-Site:
same-origin' -H 'Sec-Fetch-Mode: cors' -H 'Referer:
[http://www.google.com/search]' -H 'Accept-Encoding: gzip, deflate, br' -H
'Accept-Language: en-US,en;q=0.9' -u "admin:admin" --compressed -I
> COPY should be in the referer filter's default list of protected HTTP methods
> -----------------------------------------------------------------------------
>
> Key: SLING-9043
> URL: https://issues.apache.org/jira/browse/SLING-9043
> Project: Sling
> Issue Type: Bug
> Components: Resource Access Security
> Reporter: Sonal Gupta
> Priority: Major
> Labels: vulnerability
>
> The COPY method , by default, is not in the list of methods covered by the
> CSRF Referer filter. This might allow an attacker to copy files (abusing the
> privileges of a logged in victim) using CSRF.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
