[
https://issues.apache.org/jira/browse/SLING-9043?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17029716#comment-17029716
]
Sonal Gupta commented on SLING-9043:
------------------------------------
[~reschke] Yes, i have tested that if referrer is empty/not specified then
Forbidden error appears as empty referrer is not allowed by default.
[https://github.com/apache/sling-org-apache-sling-security/blob/master/src/main/java/org/apache/sling/security/impl/ReferrerFilter.java#L107]
Commands used:
{quote}curl
'http://localhost:8081/crx/server/crx.default/jcr%3aroot/etc/commerce' -X COPY
-H 'Connection: keep-alive' -H 'Pragma: no-cache' -H 'Cache-Control: no-cache'
-H 'X-Requested-With: XMLHttpRequest' -H 'Overwrite: T' -H 'Destination:
/crx/server/crx.default/jcr%3aroot/apps/commerce' -H 'User-Agent: Mozilla/5.0
(Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)
Chrome/79.0.3945.130 Safari/537.36' -H 'Accept: */*' -H 'Origin:
http://localhost:8081' -H 'Sec-Fetch-Site: same-origin' -H 'Sec-Fetch-Mode:
cors' -H 'Referer:' -H 'Accept-Encoding: gzip, deflate, br' -H
'Accept-Language: en-US,en;q=0.9' -u "admin:admin" --compressed -I
{quote}
{quote}curl
'http://localhost:8081/crx/server/crx.default/jcr%3aroot/etc/commerce' -X COPY
-H 'Connection: keep-alive' -H 'Pragma: no-cache' -H 'Cache-Control: no-cache'
-H 'X-Requested-With: XMLHttpRequest' -H 'Overwrite: T' -H 'Destination:
/crx/server/crx.default/jcr%3aroot/apps/commerce' -H 'User-Agent: Mozilla/5.0
(Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)
Chrome/79.0.3945.130 Safari/537.36' -H 'Accept: */*' -H 'Origin:
http://localhost:8081' -H 'Sec-Fetch-Site: same-origin' -H 'Sec-Fetch-Mode:
cors' -H 'Accept-Encoding: gzip, deflate, br' -H 'Accept-Language:
en-US,en;q=0.9' -u "admin:admin" --compressed -I
{quote}
> COPY should be in the referer filter's default list of protected HTTP methods
> -----------------------------------------------------------------------------
>
> Key: SLING-9043
> URL: https://issues.apache.org/jira/browse/SLING-9043
> Project: Sling
> Issue Type: Bug
> Components: Resource Access Security
> Reporter: Sonal Gupta
> Priority: Major
> Labels: vulnerability
>
> The COPY method , by default, is not in the list of methods covered by the
> CSRF Referer filter. This might allow an attacker to copy files (abusing the
> privileges of a logged in victim) using CSRF.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
