mainSavannah Administration - Support: sr #107055, XSRF

 
 

sr #107055: XSRF

Submitter:  Jann Horn <tajh>
Submitted:  Fri 09 Oct 2009 08:12:04 AM UTC
Votes: 55
 
Category:  Savannah trackers - bugs, tasks, etc. Priority:  5 - Normal
Severity:  6 - Security Status:  None
Privacy:  Public Assigned to:  None
Operating System:  None Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Sat 13 Feb 2010 10:48:47 PM UTC, comment #1: 

Confirmed.

Matt McCutchen <hashproduct>
Fri 09 Oct 2009 08:12:04 AM UTC, original submission:  

There seems to be a XSRF bug in the software, which allows attackers to inject spam flaggings into savannah when savannah users visit the attackers webpage, for example with the following code:
<img src="https://savannah.gnu.org/support/index.php?func=flagspam&item_id=107054&comment_internal_id=0">

Could someone please verify this and place a token into the URL, like it's done on Wikipedia?

Jann Horn <tajh>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by tajh (Voted in favor of this item)
  • -email is unavailable- added by hashproduct (Posted a comment)
  • -email is unavailable- added by hashproduct
  • -email is unavailable- added by tajh (Submitted the item)
  •  

    There are 55 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 2 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2010-06-09 tajh Carbon-Copy- Added tajh
    2010-02-13 hashproduct Carbon-Copy- Added hashproduct

    Back to the top

    Powered by Savane 3.13-bb6a.
    Corresponding source code