bugtraq - Re: Multiple XSRF in DD-WRT (Remote Root Command Execution)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <200812110042.59845.hanno@hboeck.de>
Date: Thu, 11 Dec 2008 00:42:59 +0100
From: Hanno Böck <hanno@...eck.de>
To: bugtraq@...urityfocus.com
Subject: Re: Multiple XSRF in DD-WRT (Remote Root Command Execution)

Am Mittwoch 10 Dezember 2008 schrieb s.gottschall@...wrt.com:
> in fact. just a plain POST to a authenticated dd-wrt session. without
> beeing logged in locally it would not have any effect

That's exactly the problem, as this POST can be triggered from a third-party 
webpage via javascript.

You are familiar with Cross Site Request Forgery attacks? Wikipedia gives some 
good introduction:
http://en.wikipedia.org/wiki/CSRF

All forms in web applications doing changes that require authentication need 
some extra protection to prevent CSRF. Usually this is done by some random 
token that may be created out of a random session value stored on the 
application site combined with an id of the form. This has to be checked 
before any action is executed.

-- 
Hanno Böck		Blog:		http://www.hboeck.de/
GPG: 3DBD3B20		Jabber/Mail:	hanno@...eck.de

http://www.jukss.de/ Jugemdumweltkongress, 27.12.-4.1.

Download attachment "signature.asc " of type "application/pgp-signature" (198 bytes)