search

wso2 / jaggery

The delicious Javascript framework
Apache License 2.0
115 stars 175 forks source link

Upload Jaggery application fail in carbon management console with CSRF protection #189

Open uthaiyashankar opened 5 years ago

uthaiyashankar commented 5 years ago

Upload Jaggery application fail in carbon management console with CSRF protection. This issue is reproducible with the WSO2 EMM 2.2.0 pack.

Steps to reproduce.

Start the EMM 2.2.0 Log into carbon management console Add jaggery app Hit upload You can see the following error message

[2017-03-16 11:16:49,282] WARN {org.owasp.csrfguard.log.JavaLogger} - potential cross-site request forgery (CSRF) attack thwarted (user:, ip:127.0.0.1, method:POST, uri:/fileupload/jaggeryapp, error:required token is missing from the request) Regards, Vishanth

Moved from https://wso2.org/jira/projects/JAGGERY/issues/JAGGERY-430

uthaiyashankar commented 5 years ago

The correct way to avoid this issue is sending the CSRF token along with the request. Since this is a JSP page and the request is done through a form submit, in the JSP page following should be added.

On top of the page, following taglib should be added which references the OWASP CSRF Guard.

<%@ taglib uri="http://www.owasp.org/index.php/Category:OWASP_CSRFGuard_Project/Owasp.CsrfGuard.tld" prefix="csrf" %> Then in the HTML form, following parameter should be added in the action.

<csrf:tokenname/>=<csrf:tokenvalue/>

So, the sample action looks like below.

action="../../fileupload/jaggeryapp?<csrf:tokenname/>=<csrf:tokenvalue/>"