Bug 967909 - Server trusts user returned parameters such as userID that should be tied to server state
Server trusts user returned parameters such as userID that should be tied to ...
Status: NEW
Product: PressGang CCMS
Classification: Community
Component: Web-UI (Show other bugs)
Unspecified Unspecified
unspecified Severity high
: ---
: ---
Assigned To: pressgang-ccms-dev
: Security
Depends On:
  Show dependency treegraph
Reported: 2013-05-28 10:36 EDT by Trevor Jay
Modified: 2013-07-11 01:52 EDT (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed:
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Trevor Jay 2013-05-28 10:36:35 EDT
Description of problem:

The server accepts the value of parameters such as userId from the client, when it should associate such information server-side (i.e. associate it with a session or similar mechanism).

How reproducible:


Steps to Reproduce:
1. Make an update through a POST, but change the value of the userId

Actual results:

The userId value that is changed is reflected in the user field of the revision history.

Expected results:

Tampering with the userId or other identity/origin information should not be possible (i.e. userId is not passed by client), have no effect, or result in an error.

Additional info:

This bug is part of a trio of bugs featured in a proof-of-concept (POC) drive-by attack I've written. For the others, see: https://bugzilla.redhat.com/buglist.cgi?f1=cf_qa_whiteboard&o1=substring&query_format=advanced&v1=poc-fc5fd70a912b

To try out the POC, visit: 


That page will generate a random nonce and attempt to add it to a PressGang topic. Open the PressGang link presented by the POC in another tab and scroll to the bottom of the XML source. You should see the nonce created in the POC has been successfully embedded in the form of a comment. Finally, examine the revisions tab and see that this revision has been associated with the user mcaspers and that the revision message also refers to the generated nonce.

In summary, arbitrary web-content can make changes to PressGang resources and associate those changes with any user. Since PressGang currently lacks authentication of any kind, there is no user or session protection to constrain the timing of these attacks to when users are "logged in". The VPN also offers no protection. Malicious users outside Red Hat may make changes to PressGang topics at will simply by having users browse malicious content while connected to the VPN.

Note You need to log in before you can comment on or make changes to this bug.