Open zidingz opened 3 years ago
If you'd like to communicate with the original discloser of this security issue, or ensure he is rewarded for his research, simply let me know which GitHub users you wish to be authorised to visit the report pages below, and I'll get it sorted for you.
Reports: https://huntr.dev/bounties/4f9df0a7-6388-4fef-9476-d8aa9b956d58/ https://huntr.dev/bounties/5474bb43-2bf5-4c72-9abc-fccd4dd13e92/ https://huntr.dev/bounties/4fefa8f2-5743-4793-a595-90a822708e47/ https://huntr.dev/bounties/b8da7d50-c25b-408b-bc34-a4e69bd867fc/ https://huntr.dev/bounties/c0e0caba-0cd9-4fdf-a98e-886a93adf49c/
Hey Guys, I am the original discloser of these security issues. Please advise or give me an update on this. It would be great help and confidence booster for my work.
Description
A cross-site request forgery (CSRF) vulnerability occurs when: A Web application uses session cookies. The application acts on an HTTP request without verifying that the request was made with the user's consent.
There are 5 cases of CSRF in ui-grid.
The form post at fileChooserEditor.html line 2 must contain a user-specific secret in order to prevent an attacker from making unauthorized requests.
Location: https://github.com/angular-ui/ui-grid/blob/4aa2cc59a6bc683552a1e328f639a0aa0a0c7527/packages/edit/src/templates/fileChooserEditor.html#L1-L12
PoC (L149):
The form post at index.html line 124 and line 149 must contain a user-specific secret in order to prevent an attacker from making unauthorized requests.
Location (124-128): https://github.com/angular-ui/ui-grid/blob/4aa2cc59a6bc683552a1e328f639a0aa0a0c7527/misc/site/customizer/index.html#L124-L128
Location (149-152): https://github.com/angular-ui/ui-grid/blob/4aa2cc59a6bc683552a1e328f639a0aa0a0c7527/misc/site/customizer/index.html#L149-L152
The form post at importerMenuItem.html line 3 must contain a user-specific secret in order to prevent an attacker from making unauthorized requests.
Location: https://github.com/angular-ui/ui-grid/blob/4aa2cc59a6bc683552a1e328f639a0aa0a0c7527/packages/importer/src/templates/importerMenuItem.html#L1-L10
The form post at dropdownEditor.html line 2 must contain a user-specific secret in order to prevent an attacker from making unauthorized requests.
Location: https://github.com/angular-ui/ui-grid/blob/4aa2cc59a6bc683552a1e328f639a0aa0a0c7527/packages/edit/src/templates/dropdownEditor.html#L1-L11
The form post at cellEditor.html line 2 must contain a user-specific secret in order to prevent an attacker from making unauthorized requests.
Location: https://github.com/angular-ui/ui-grid/blob/4aa2cc59a6bc683552a1e328f639a0aa0a0c7527/packages/edit/src/templates/cellEditor.html#L1-L10