[
https://issues.apache.org/jira/browse/STORM-460?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14111192#comment-14111192
]
ASF GitHub Bot commented on STORM-460:
--------------------------------------
Github user harshach commented on a diff in the pull request:
https://github.com/apache/incubator-storm/pull/230#discussion_r16736988
--- Diff: storm-core/src/clj/backtype/storm/ui/core.clj ---
@@ -687,7 +688,8 @@
"bolts" (bolt-comp id bolt-comp-summs (.get_errors summ) window
include-sys?)
"configuration" topology-conf
"visualizationTable" (stream-boxes visualizer-data)
- "uiActionsEnabled" (ui-actions-enabled?)}))))
+ "uiActionsEnabled" (ui-actions-enabled?)
+ "anti-forgery-token" *anti-forgery-token*}))))
--- End diff --
can you rename this to antiForgeryToken
> CSRF vulnerability in storm UI
> ------------------------------
>
> Key: STORM-460
> URL: https://issues.apache.org/jira/browse/STORM-460
> Project: Apache Storm (Incubating)
> Issue Type: Bug
> Affects Versions: feature-security
> Reporter: Parth Brahmbhatt
>
> If you are already kerberized and visit a webpage that malliciosly posts
> this request
> http://storm-ui-root/api/v1/topology/storm-6-1406915499/kill/30
> it will end up killing a topology with id storm-6-1406915499.
> To reproduce the issue, open storm ui in secure or non secure mode once using
> any browser. You can then close the storm ui tab. Usig chrome
> https://chrome.google.com/webstore/detail/postman-rest-client/fdmmgilgnpjigdojojpjoooidkmcomcm
> or curl post this request
> http://<storm-ui-root>/api/v1/topology/<your topology id>/kill/30
> It should end up killing the topology.
> See http://en.wikipedia.org/wiki/Cross-site_request_forgery to understand
> CSRF vulenrability.
--
This message was sent by Atlassian JIRA
(v6.2#6252)
