GSMcNamara
128 lines
5.6 KiB
Plaintext
Executable File
128 lines
5.6 KiB
Plaintext
Executable File
<div class="widget">
|
||
<div class="widget-header">
|
||
<div class="title">
|
||
<span class="fs1" aria-hidden="true" data-icon=""></span> A5 - Cross Site Request Forgery (CSRF)
|
||
</div>
|
||
</div>
|
||
<div class="widget-body">
|
||
<div id="accordion1" class="accordion no-margin">
|
||
<div class="accordion-group">
|
||
<div class="accordion-heading">
|
||
<a href="#collapseOne" data-parent="#accordion1" data-toggle="collapse" class="accordion-toggle">
|
||
<i class="icon-info icon-white">
|
||
</i>
|
||
Description
|
||
</a>
|
||
</div>
|
||
<div class="accordion-body in collapse" id="collapseOne" style="height: auto;">
|
||
<div class="accordion-inner">
|
||
<p>A CSRF attack forces a logged-on victim’s browser to send a forged HTTP request, including the victim’s session cookie and any other automatically included authentication information, to a vulnerable web application. This allows the attacker to force the victim’s browser to generate requests the vulnerable application thinks are legitimate requests from the victim.</p>
|
||
</div>
|
||
</div>
|
||
</div>
|
||
<div class="accordion-group">
|
||
<div class="accordion-heading">
|
||
<a href="#collapseTwo" data-parent="#accordion1" data-toggle="collapse" class="accordion-toggle">
|
||
<i class="icon-bug icon-white">
|
||
</i>
|
||
Bug
|
||
</a>
|
||
</div>
|
||
<div class="accordion-body collapse" id="collapseTwo" style="height: 0px;">
|
||
<div class="accordion-inner">
|
||
<p><b>Cross-Site Request Forgery (CSRF) - The following code was taken from: /app/controllers/application_controller.rb and /app/views/layouts/application.html.erb</b></p>
|
||
<p>application_controller.rb<p>
|
||
<p>
|
||
<pre class="ruby">
|
||
# Our security guy keep talking about sea-surfing, cool story bro.
|
||
# protect_from_forgery
|
||
</pre>
|
||
|
||
</p>
|
||
<p> application.html.erb </p>
|
||
<p>
|
||
<pre class="ruby">
|
||
<%= @meta_code_bad %>
|
||
</pre>
|
||
</p>
|
||
</div>
|
||
</div>
|
||
</div>
|
||
<div class="accordion-group">
|
||
<div class="accordion-heading">
|
||
<a href="#collapseThree" data-parent="#accordion1" data-toggle="collapse" class="accordion-toggle">
|
||
<i class="icon-lightning icon-white">
|
||
</i>
|
||
Solution
|
||
</a>
|
||
</div>
|
||
<div class="accordion-body collapse" id="collapseThree" style="height: 0px;">
|
||
<div class="accordion-inner">
|
||
<p><b> Cross-Site Request Forgery ATTACK:</b></p>
|
||
<p class="desc">
|
||
The application allows users to update their calendar and schedule PTO events (PTO section). Due to the fact CSRF protections are disabled, the AJAX request will send the authenticity token but the application will <b>not</b> validate either its presence or validity. Create an html page using the code shown below, authenticate as another user, click on it, review the new calendar (change the dates under date_range1). You should see this HTML code will work, even if you hadn't navigated to the PTO section prior to sending it.
|
||
</p>
|
||
<p>
|
||
<pre class="ruby">
|
||
<%=
|
||
%{
|
||
<html>
|
||
<body>
|
||
<form action="http://railsgoat.dev/schedule.json" method="POST">
|
||
<input type="hidden" name="schedule[event_name]" value="Bad Guy" />
|
||
<input type="hidden" name="schedule[event_type]" value="pto" />
|
||
<input type="hidden" name="schedule[event_desc]" value="Fun Fun" />
|
||
<input type="hidden" name="date_range1" value="06/08/2013 - 06/09/2013" />
|
||
<input type="submit" value="Submit request" />
|
||
</form>
|
||
</body>
|
||
</html>
|
||
}
|
||
%>
|
||
</pre>
|
||
</p>
|
||
|
||
<p><b> Cross-Site Request Forgery SOLUTION:</b></p>
|
||
<p>
|
||
By Default, the protect_from_forgery directive is added under the application_controller.rb at project creation. However, occasionally developers turn it off (comment out) because of issues with JS. There are two separate solutions around the JS problem.
|
||
</p>
|
||
<p>
|
||
Once protect_from_forgery is added back...
|
||
<li>Add the following code within the header section of the application.html.erb file (or any other application layout file).</li>
|
||
</p>
|
||
<p>
|
||
<pre class="ruby">
|
||
<%= @meta_code_good %>
|
||
</pre>
|
||
</p>
|
||
<p>
|
||
That will allow you to parse the meta tag with JS. However, keep in mind that any form generated by Rails is populated with an authenticity token so, if you leverage something like JQuery to make an Ajax request, you can include all values within the form by using the technique shown next.
|
||
</p>
|
||
<p>
|
||
<li>Leverage the serialize() method, shown on line 3. This grabs all the values from the form, including the authenticity token.</li>
|
||
</p>
|
||
<p>
|
||
<pre class="ruby">
|
||
<%= @ajax_code_good %>
|
||
</pre>
|
||
</p>
|
||
</div>
|
||
</div>
|
||
</div>
|
||
<div class="accordion-group">
|
||
<div class="accordion-heading">
|
||
<a style="background-color: rgb(181, 121, 158)" href="#collapseFour" data-parent="#accordion1" data-toggle="collapse" class="accordion-toggle">
|
||
<i class="icon-aid icon-white">
|
||
</i>
|
||
Hint
|
||
</a>
|
||
</div>
|
||
<div class="accordion-body collapse" id="collapseFour" style="height: 0px;">
|
||
<div class="accordion-inner">
|
||
PTO is precious, glad my calendar is safe!
|
||
</div>
|
||
</div>
|
||
</div>
|
||
</div>
|
||
</div>
|
||
</div> |