Bug 967908

Description of problem:

The WebDAV interface returns a:

Access-Control-Allow-Origin: *

header. 

How reproducible:

always.

Steps to Reproduce:
1. From a bash shell with netcat installed as nc, access the WebDAV interface with the following one-liner:

echo -e "PROPFIND /pressgang-ccms/webdav/ HTTP/1.1\r\nHost: skynet.usersys.redhat.com:8080\r\nDepth: 1\r\nContent-Type: application/xml\r\n\r\n<?xml version="1.0" encoding="utf-8"?>\n<propfind xmlns="DAV:"><prop>\n<getcontentlength xmlns="DAV:"/>\n<getlastmodified xmlns="DAV:"/>\n<executable xmlns="http://apache.org/dav/props/"/>\n<resourcetype xmlns="DAV:"/>\n<checked-in xmlns="DAV:"/>\n<checked-out xmlns="DAV:"/>\n</prop></propfind>\r\n\r\n" | nc skynet.usersys.redhat.com 8080


Actual results:

Receive the "directory" listing (as expected) with a:

Access-Control-Allow-Origin: *

header.

Expected results:

Receive the "directory" listing with headers that would appropriately block cross-site access.

Additional info:

Some browsers allow calls to methods such as PROPFIND. Combined with this header behavior there is the potential for JavaScript access to the WebDAV interface from arbitrary websites. Drive by attacks similar to the one detailed in the bugs relating to: https://bugzilla.redhat.com/buglist.cgi?f1=cf_qa_whiteboard&o1=substring&query_format=advanced&v1=poc-fc5fd70a912b seem quite likely. As with that POC, an attacker need not have VPN access, only the ability to have victims within the VPN browse content.