Hanno =?utf-8?q?B=C3=B6ck?=
11/12/08, 17:05
--nextPart6163756.eWvOUueb0J
Content-Type: text/plain;
charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
Am Mittwoch 10 Dezember 2008 schrieb s.gottschall@dd-wrt.com:
> in fact. just a plain POST to a authenticated dd-wrt session. without
> beeing logged in locally it would not have any effect
That's exactly the problem, as this POST can be triggered from a third-part=
y=20
webpage via javascript.
You are familiar with Cross Site Request Forgery attacks? Wikipedia gives s=
ome=20
good introduction:
http://en.wikipedia.org/wiki/CSRF
All forms in web applications doing changes that require authentication nee=
d=20
some extra protection to prevent CSRF. Usually this is done by some random=
=20
token that may be created out of a random session value stored on the=20
application site combined with an id of the form. This has to be checked=20
before any action is executed.
=2D-=20
Hanno B=C3=B6ck Blog: http://www.hboeck.de/
GPG: 3DBD3B20 Jabber/Mail: hanno@hboeck.de
http://www.jukss.de/ Jugemdumweltkongress, 27.12.-4.1.
--nextPart6163756.eWvOUueb0J
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: This is a digitally signed message part.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.9 (GNU/Linux)
iEYEABECAAYFAklAVAMACgkQr2QksT29OyCdEACeIk/TOGySA+gImzHxe9iuDfqN
z9MAoJl1Kh3hYKtL82TNUbGlTZvprVGu
=M4L+
-----END PGP SIGNATURE-----
--nextPart6163756.eWvOUueb0J--
Content-Type: text/plain;
charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
Am Mittwoch 10 Dezember 2008 schrieb s.gottschall@dd-wrt.com:
> in fact. just a plain POST to a authenticated dd-wrt session. without
> beeing logged in locally it would not have any effect
That's exactly the problem, as this POST can be triggered from a third-part=
y=20
webpage via javascript.
You are familiar with Cross Site Request Forgery attacks? Wikipedia gives s=
ome=20
good introduction:
http://en.wikipedia.org/wiki/CSRF
All forms in web applications doing changes that require authentication nee=
d=20
some extra protection to prevent CSRF. Usually this is done by some random=
=20
token that may be created out of a random session value stored on the=20
application site combined with an id of the form. This has to be checked=20
before any action is executed.
=2D-=20
Hanno B=C3=B6ck Blog: http://www.hboeck.de/
GPG: 3DBD3B20 Jabber/Mail: hanno@hboeck.de
http://www.jukss.de/ Jugemdumweltkongress, 27.12.-4.1.
--nextPart6163756.eWvOUueb0J
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: This is a digitally signed message part.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.9 (GNU/Linux)
iEYEABECAAYFAklAVAMACgkQr2QksT29OyCdEACeIk/TOGySA+gImzHxe9iuDfqN
z9MAoJl1Kh3hYKtL82TNUbGlTZvprVGu
=M4L+
-----END PGP SIGNATURE-----
--nextPart6163756.eWvOUueb0J--