CDR-01-003 Web: Stored XSS in CiviCDR Backend

[seamustuohy]

The web application allows service providers or implementing partners to specify a public PGP key in their profile. Said key may then be used for contacting a given party. The PGP keys are hosted on the backend via a “public” accessible route, which means no authentication is needed for those seeking to acquire the public key of an account.

It was discovered that the endpoint provides insufficient HTTP security headers and solely relies on the Content-Type: text/plain header as a protection mechanism. As the sp_profiles/:id/key endpoint can be iframed, it is possible to use Internet Explorer and a EML document to interpret text/plain as HTML and therefore execute JavaScript in the security context of the backend domain

Recommendations:

• It is recommended to prohibit framing of the public key endpoints and instruct the browser not to perform Content Sniffing. This approach should ideally be extended to the entire website. When implemented, mitigation strategy will prevent any browser from interpreting the web page with a different content-type. Therefore, these kinds of XSS attacks against the backend will be blocked.
• All "public" routes should be made into private routes
• To accomplish the desired protection, implementing the security headers proposed under CDR-01-001 will solve this issue. Among the many proposals provided in the aforementioned vulnerability’s description, the most important to mitigate this particular issue are the following

X-Frame-Options: DENY
X-Content-Type-Options: nosniff

[seamustuohy]

Mitigation Plan:

• 003: remove pgp public key route

[majorzazz]

@seamustuohy, would it be acceptable for us to just remove that public endpoint altogether, and move the listing of PGP keys to only the IP/SP profile pages, visible only to the admins (and the IP/SP user who owns that profile)? That is, if the Admin is going to be sharing the keys to users, on a need-to-know basis, then they're the only ones who need to view them?

[seamustuohy]

Yeah, I think that is the right way to go.