Bug 1299614 (CVE-2016-0720) - CVE-2016-0720 pcs: Cross-Site Request Forgery in web UI
Summary: CVE-2016-0720 pcs: Cross-Site Request Forgery in web UI
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2016-0720
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=moderate,public=20160216,repor...
Depends On: 1308827 1330884
Blocks: 1299618 1323912
TreeView+ depends on / blocked
 
Reported: 2016-01-18 18:45 UTC by Martin Prpič
Modified: 2019-06-08 20:56 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
A Cross-Site Request Forgery (CSRF) flaw was found in the pcsd web UI. A remote attacker could provide a specially crafted web page that, when visited by a user with a valid pcsd session, would allow the attacker to trigger requests on behalf of the user, for example removing resources or restarting/removing nodes.
Clone Of:
Environment:
Last Closed: 2016-11-06 04:27:28 UTC


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2016:2596 normal SHIPPED_LIVE Moderate: pcs security, bug fix, and enhancement update 2016-11-03 12:11:34 UTC

Description Martin Prpič 2016-01-18 18:45:23 UTC
The pcsd web UI is vulnerable to Cross-Site Request Forgery (CSRF). A remote attacker could provide a specially crafted web page that, when visited by a user with a valid pcsd session, would allow the attacker to trigger requests on behalf of the user, for example removing resources, restarting/removing nodes, etc.

Each request includes 'X-Requested-With: XMLHttpRequest' but this header is not checked server side.

Comment 1 Ján Rusnačko 2016-01-19 07:23:58 UTC
Acknowledgements:

Name: Martin Prpic (Red Hat Product Security)

Comment 2 Martin Prpič 2016-01-19 09:35:45 UTC
Statement:

This issue is not currently planned to be addressed in future updates of Red Hat Enterprise Linux 6, as the web UI functionality is disabled by default in pcsd.

Comment 4 Martin Prpič 2016-02-16 08:53:54 UTC
Created pcs tracking bugs for this issue:

Affects: fedora-all [bug 1308827]

Comment 5 Fedora Update System 2016-03-02 21:50:28 UTC
pcs-0.9.149-2.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.

Comment 6 Fedora Update System 2016-03-03 20:25:41 UTC
pcs-0.9.149-2.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.

Comment 8 errata-xmlrpc 2016-11-03 20:56:14 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2016:2596 https://rhn.redhat.com/errata/RHSA-2016-2596.html


Note You need to log in before you can comment on or make changes to this bug.