1306589 - BMO: CSRF vulnerability allows deleting admin queue entries

Status: RESOLVED FIXED

(bugzilla.mozilla.org :: General, defect)

Description

[Wladimir Palant]

BMO has a Push extension providing some admin queues, e.g. the "Pending Queue" displays all objects created. If I were to attack Bugzilla, I would have some interest in clearing out these queues - and a CSRF vulnerability actually makes this possible. E.g. if you want to delete a message with ID 1 from the Pending Queue and you get a Bugzilla admin to visit your website you can add the following code to the page:

  <img src="https://buzilla.mozilla.org/page.cgi?id=push_queues_view.html&message=1&delete=1">

When a Bugzilla admin opens that page their browser will make a request to https://buzilla.mozilla.org/page.cgi?id=push_queues_view.html&message=1&delete=1 and cause the message to be deleted - there is no CSRF token, and this doesn't even need to be a POST request.

There is a complication here of course, one needs to know the message ID. As the IDs are sequential, this is solvable however. A script on the page could just keep incrementing the ID, and it might be able to speed up the process via timing attacks - time to response should be different for valid and invalid IDs, which would allow finding the range with valid IDs relatively quickly.

Comment 1

[April King [:April]]

Moving this into the Bugzilla space so that BMO folks can take a look at it.

Comment 2

[April King [:April]]

:dylan will be talking about what this particularly queue is, and why it's rated as sec-low.  Thanks, Dylan!  And nice find as always, Vlad.  :)

Comment 3

[Dylan Hardison [:dylan] (he/him)]

The only feasible queue to attack would be mozreview, and the window for the attack would be quite small,
you would have on average 1 second.
BMO as it currently runs *isn't fast enough* for this to be feasible, that number of requests would be a denial of service attack
and would as a result be very noticeable. 

The benefit of the attack would be mozreview attachments for bugs that were retroactively made security bugs staying public.
That is serious (although it would be smarter to just watch all mozreview patches and mark any that disappear as "interesting").

Comment 4

[David Lawrence [:dkl]]

Attachment: 1306589_1.patch

Comment 5

[Dylan Hardison [:dylan] (he/him)]

Comment on attachment 8796659 [details] [diff] [review]
1306589_1.patch

r=dylan

dkl++ for making this method="post" too

Comment 6

[David Lawrence [:dkl]]

Thanks. Waiting to commit once we are ready to push.

dkl

Comment 7

[Daniel Veditz [:dveditz] out until Nov 10]

The risk from this bug to BMO does not meet the bug bounty bar, but thank you for reporting it.

Comment 8

[David Lawrence [:dkl]]

To https://github.com/mozilla-bteam/bmo.git
   3078746..1257347  master -> master

Comment 9

[Wladimir Palant]

Can this bug be made visible?

Comment 10

[David Lawrence [:dkl]]

Yeah. Was waiting til it was released and then forgot after it was.

dkl