1764724 - CSRF On stealing lock in support.mozilla.org

Status: RESOLVED FIXED

(support.mozilla.org :: General, task)

Description

[roldanbrandon62]

Hi. The steal-lock function, allows get request making it vulnerable to csrf attacks since get requests in django doesnt need csrf protections. The endpoint is defined in wiki/urls.py in

    re_path(r"^/steal_lock$", views.steal_lock, name="wiki.steal_lock"),

This is the steal lock function

@login_required
def steal_lock(request, document_slug, revision_id=None):
    doc = get_object_or_404(Document, locale=request.LANGUAGE_CODE, slug=document_slug)
    user = request.user

    ok = _document_lock_steal(doc.id, user.username)
    return HttpResponse("", status=200 if ok else 400)

So, when we trick a victim into following https://support.allizom.org/en-US/kb/<article_slug>/steal_lock, the document will be locked even if the victim is not actually editing the article.

Comment 1

[Frida K [:frida]]

Hello Brandon,

Thank you for your report.

Were you able to reproduce this issue in the app?

Thanks,
Frida

Comment 2

[roldanbrandon62]

Hi. Yeah. For the steps to reproduce

1. Have two accounts, we will call these two users as user a and user b
2. Pick an article
3. As user a, go to https://support.allizom.org/en-US/kb/<article_slug>/steal_lock replace article_slug with the article that you chose
4. Now as user b, try editing the article and you will see the lock saying that user a is editing the article without user a knowing

Comment 3

[Frida K [:frida]]

Users are still able to edit the article as you can see in the attached screenshot, tricking the user to lock the article won't completely deny other users from editing the article.

Comment 4

[Frida K [:frida]]

Attachment: other users are still able to edit locked articles

Comment 5

[roldanbrandon62]

Hi. Yes but i thought it would still be worth reporting. With this, the victim wont know and wont be able to remove the lock unless other people take the lock. Other people might not be able to work to the article thinking someone is already working on it

Comment 6

[Frida K [:frida]]

true, I agree that we need to address the issue, however, I assigned it with low severity since it doesn't completely restrict other users from editing the article.

Comment 7

[Frida K [:frida]]

Hello Tasos,

Can you please take a look? This is another endpoint that is vulnerable to CSRF.

Thanks,
Frida

Comment 8

[Tasos Katsoulas [:tasos]]

Thanks Frida. Given the other bugs filed, I would agree this is low severity. I will return to this once more important bugs are fixed.

Comment 9

[Tasos Katsoulas [:tasos]]

PR https://github.com/mozilla/kitsune/pull/5106

Comment 10

[Tasos Katsoulas [:tasos]]

The fix has been released to prod.