[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[EP-tech] CSRF Vulnerability in EPrints



It's not appropriate to discuss software vulnerabilities on a publicly archived thread. If a bug does exist, then it should be raised quietly so that people get told about it at the same time as an upgrade or patch to fix it.



On 28/03/2019 09:55, Adam Field via Eprints-tech wrote:
Hi

                We?ve had a report from an independent security researcher (Jisc?s policy encourages reporting of issues) that EPrints suffers from a CSRF vulnerability.  The fix for this would be to add tokens to forms so that EPrints can validate that a submitted form was one that it generated.

                This is obviously a fairly complex problem to solve, with changes to multiple parts of EPrints, probably requiring a new field type, as well as the storing of tokens somewhere (perhaps a new dataset).  Has anyone taken a look at this?

Thanks

--
Adam



*** Options: http://mailman.ecs.soton.ac.uk/mailman/listinfo/eprints-tech
*** Archive: http://www.eprints.org/tech.php/<https://eur03.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.eprints.org%2Ftech.php%2F&data=01%7C01%7C%7Ce8159371f7ae4b09ef9a08d6b36c5b27%7C4a5378f929f44d3ebe89669d03ada9d8%7C0&sdata=eUIQul%2BRi0U49MY9sMbu9mlmQ%2BhoTYlQlK3yQj6jhLs%3D&reserved=0>
*** EPrints community wiki: http://wiki.eprints.org/<https://eur03.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwiki.eprints.org%2F&data=01%7C01%7C%7Ce8159371f7ae4b09ef9a08d6b36c5b27%7C4a5378f929f44d3ebe89669d03ada9d8%7C0&sdata=iL9lfJuzdPACx3icQufbtfYquLOxM8Iz95bATfIWGh8%3D&reserved=0>
*** EPrints developers Forum: http://forum.eprints.org/<https://eur03.safelinks.protection.outlook.com/?url=http%3A%2F%2Fforum.eprints.org%2F&data=01%7C01%7C%7Ce8159371f7ae4b09ef9a08d6b36c5b27%7C4a5378f929f44d3ebe89669d03ada9d8%7C0&sdata=Gk5JyoXcDC7MOEc6I7ndBakYJrGalMb2qxs6GuDrneQ%3D&reserved=0>


--
Christopher Gutteridge <totl at soton.ac.uk><mailto:totl at soton.ac.uk>
You should read our team blog at http://blog.soton.ac.uk/webteam/
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ecs.soton.ac.uk/pipermail/eprints-tech/attachments/20190328/72a5d128/attachment-0001.html