Bug 1299614 (CVE-2016-0720) - CVE-2016-0720 pcs: Cross-Site Request Forgery in web UI
Summary: CVE-2016-0720 pcs: Cross-Site Request Forgery in web UI
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2016-0720
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1308827 1330884
Blocks: 1299618 1323912
TreeView+ depends on / blocked
 
Reported: 2016-01-18 18:45 UTC by Martin Prpič
Modified: 2021-02-17 04:30 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
A Cross-Site Request Forgery (CSRF) flaw was found in the pcsd web UI. A remote attacker could provide a specially crafted web page that, when visited by a user with a valid pcsd session, would allow the attacker to trigger requests on behalf of the user, for example removing resources or restarting/removing nodes.
Clone Of:
Environment:
Last Closed: 2016-11-06 04:27:28 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2016:2596 0 normal SHIPPED_LIVE Moderate: pcs security, bug fix, and enhancement update 2016-11-03 12:11:34 UTC

Description Martin Prpič 2016-01-18 18:45:23 UTC 
The pcsd web UI is vulnerable to Cross-Site Request Forgery (CSRF). A remote attacker could provide a specially crafted web page that, when visited by a user with a valid pcsd session, would allow the attacker to trigger requests on behalf of the user, for example removing resources, restarting/removing nodes, etc.

Each request includes 'X-Requested-With: XMLHttpRequest' but this header is not checked server side.
Comment 1 Ján Rusnačko 2016-01-19 07:23:58 UTC 
Acknowledgements:

Name: Martin Prpic (Red Hat Product Security)
Comment 2 Martin Prpič 2016-01-19 09:35:45 UTC 
Statement:

This issue is not currently planned to be addressed in future updates of Red Hat Enterprise Linux 6, as the web UI functionality is disabled by default in pcsd.
Comment 3 Martin Prpič 2016-02-16 08:51:19 UTC 
Upstream patches:

https://github.com/feist/pcs/commit/3360ecd318f7631bf5826d99a20bf4b29d86dc9c
https://github.com/feist/pcs/commit/d49435de20f71bd0816c42b445ed484dd21fbe96
https://github.com/feist/pcs/commit/b9e7f061788c3b86a0c67d2d4158f067ec5eb625
Comment 4 Martin Prpič 2016-02-16 08:53:54 UTC 
Created pcs tracking bugs for this issue:

Affects: fedora-all [bug 1308827]
Comment 5 Fedora Update System 2016-03-02 21:50:28 UTC 
pcs-0.9.149-2.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.
Comment 6 Fedora Update System 2016-03-03 20:25:41 UTC 
pcs-0.9.149-2.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.
Comment 8 errata-xmlrpc 2016-11-03 20:56:14 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2016:2596 https://rhn.redhat.com/errata/RHSA-2016-2596.html
Note You need to log in before you can comment on or make changes to this bug.